diff options
| author | Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> | 2022-11-07 17:10:21 +0900 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-11-08 17:49:05 -0800 |
| commit | 380f9acdf74729d79972b947820f00b42cc26dae (patch) | |
| tree | 9d9eeb60afb6b58980ed6b25397bf1e5fcf5e26c /drivers/net/ethernet/renesas/rswitch.c | |
| parent | 8e18be7610aebea50e9327c11afcd5eeaaa06644 (diff) | |
net: ethernet: renesas: rswitch: Fix endless loop in error paths
Coverity reported that the error path in rswitch_gwca_queue_alloc_skb()
has an issue to cause endless loop. So, fix the issue by changing
variables' types from u32 to int. After changed the types,
rswitch_tx_free() should use rswitch_get_num_cur_queues() to
calculate number of current queues.
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1527147 ("Control flow issues")
Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20221107081021.2955122-1-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/ethernet/renesas/rswitch.c')
| -rw-r--r-- | drivers/net/ethernet/renesas/rswitch.c | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 4f7af6393c9e..f3d27aef1286 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -219,9 +219,9 @@ static void rswitch_ack_data_irq(struct rswitch_private *priv, int index) iowrite32(BIT(index % 32), priv->addr + offs); } -static u32 rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, u32 num) +static int rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, int num) { - u32 index = cur ? gq->cur : gq->dirty; + int index = cur ? gq->cur : gq->dirty; if (index + num >= gq->ring_size) index = (index + num) % gq->ring_size; @@ -231,7 +231,7 @@ static u32 rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, u32 return index; } -static u32 rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq) +static int rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq) { if (gq->cur >= gq->dirty) return gq->cur - gq->dirty; @@ -250,9 +250,9 @@ static bool rswitch_is_queue_rxed(struct rswitch_gwca_queue *gq) } static int rswitch_gwca_queue_alloc_skb(struct rswitch_gwca_queue *gq, - u32 start_index, u32 num) + int start_index, int num) { - u32 i, index; + int i, index; for (i = 0; i < num; i++) { index = (i + start_index) % gq->ring_size; @@ -410,12 +410,12 @@ err: static int rswitch_gwca_queue_ts_fill(struct net_device *ndev, struct rswitch_gwca_queue *gq, - u32 start_index, u32 num) + int start_index, int num) { struct rswitch_device *rdev = netdev_priv(ndev); struct rswitch_ext_ts_desc *desc; dma_addr_t dma_addr; - u32 i, index; + int i, index; for (i = 0; i < num; i++) { index = (i + start_index) % gq->ring_size; @@ -736,7 +736,8 @@ static int rswitch_tx_free(struct net_device *ndev, bool free_txed_only) int free_num = 0; int size; - for (; gq->cur - gq->dirty > 0; gq->dirty = rswitch_next_queue_index(gq, false, 1)) { + for (; rswitch_get_num_cur_queues(gq) > 0; + gq->dirty = rswitch_next_queue_index(gq, false, 1)) { desc = &gq->ring[gq->dirty]; if (free_txed_only && (desc->desc.die_dt & DT_MASK) != DT_FEMPTY) break; |