Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

eth: fbnic: Fix counter roll-over issue 

Fix a potential counter roll-over issue in fbnic_mbx_alloc_rx_msgs()
when calculating descriptor slots. The issue occurs when head - tail
results in a large positive value (unsigned) and the compiler interprets
head - tail - 1 as a signed value.

Since FBNIC_IPC_MBX_DESC_LEN is a power of two, use a masking operation,
which is a common way of avoiding this problem when dealing with these
sort of ring space calculations.

Fixes: da3cde0820 ("eth: fbnic: Add FW communication mechanism")
Signed-off-by: Mohsin Bashir <mohsin.bashr@gmail.com>
Link: https://patch.msgid.link/20251125211704.3222413-1-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Mohsin Bashir 2025-11-25 13:17:04 -08:00 committed by Jakub Kicinski
parent 27fd028601
commit 6d66e093e0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/ethernet/meta/fbnic/fbnic_fw.c
View File

@ -201,7 +201,7 @@ static int fbnic_mbx_alloc_rx_msgs(struct fbnic_dev *fbd)
return -ENODEV; return -ENODEV;
/* Fill all but 1 unused descriptors in the Rx queue. */ /* Fill all but 1 unused descriptors in the Rx queue. */
count = (head - tail - 1) % FBNIC_IPC_MBX_DESC_LEN; count = (head - tail - 1) & (FBNIC_IPC_MBX_DESC_LEN - 1);
while (!err && count--) { while (!err && count--) {
struct fbnic_tlv_msg *msg; struct fbnic_tlv_msg *msg;