[PATCH v4-S2 01/13] net/dpaa2: fix integer overflow in CCSR region mapping
flat view
HOTtoday
From: Prashant Gupta <hidden>
Date: 2026-09-22 09:55:39
Subsystem:
networking drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
From: Hemant Agrawal <redacted>
In lsx_ccsr_map_region, PAGE_SIZE is defined as sysconf(_SC_PAGESIZE)
which may be negative on error. The value was used directly in size_t
comparisons and passed to mmap, causing an integer overflow (Coverity
CID 49765682).
Use sysconf() explicitly with a signed long, check for errors, and
compute map_len separately with unsigned arithmetic before passing to
mmap.
Coverity issue: 49765682
Fixes: f023d059769f ("net/dpaa2: support recycle loopback port")
Cc: stable@dpdk.org
Signed-off-by: Hemant Agrawal <redacted>
---
drivers/net/dpaa2/dpaa2_recycle.c | 39 ++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 13 deletions(-)
diff --git a/drivers/net/dpaa2/dpaa2_recycle.c b/drivers/net/dpaa2/dpaa2_recycle.c
index f78d12362e..ef7caa5f19 100644
--- a/drivers/net/dpaa2/dpaa2_recycle.c
+++ b/drivers/net/dpaa2/dpaa2_recycle.c@@ -30,11 +30,6 @@ #include <unistd.h> #include <sys/mman.h> -#ifndef PAGE_SIZE -#define PAGE_SIZE (sysconf(_SC_PAGESIZE)) -#endif -#define PAGE_MASK (~(PAGE_SIZE - 1)) - #define LSX_SERDES_LAN_NB 8 #define LSX_SERDES_REG_BASE 0x1ea0000 #define LSX_LB_EN_BIT 0x10000000
@@ -176,6 +171,9 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len) void *tmp; uint64_t start; uint64_t offset; + uint64_t page_mask; + long page_size; + size_t map_len; fd = open("/dev/mem", O_RDWR); if (fd < 0) {
@@ -183,20 +181,35 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len) return NULL; } - start = addr & PAGE_MASK; + page_size = sysconf(_SC_PAGESIZE); + if (page_size <= 0) { + close(fd); + return NULL; + } + page_mask = ~((uint64_t)page_size - 1); + start = addr & page_mask; offset = addr - start; - len = len & PAGE_MASK; - if (len < (size_t)PAGE_SIZE) - len = PAGE_SIZE; + len = len & page_mask; + if (len == 0) { + close(fd); + return NULL; + } - tmp = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, start); + map_len = len; + if (map_len < (size_t)page_size) + map_len = (size_t)page_size; + + tmp = mmap(NULL, map_len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, start); close(fd); - if (tmp != MAP_FAILED) - return (uint8_t *)tmp + offset; - else + if (tmp == MAP_FAILED) { + DPAA2_PMD_ERR("mmap 0x%" PRIx64 "(size=0x%zx) failed", + addr, map_len); return NULL; + } + + return (uint8_t *)tmp + offset; } static const uint8_t ls_sd1_prot_idx_map[] = {
--
2.43.0