From 97717aca618a85d9e52327b4509a3b95c2f8f121 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Fri, 10 Mar 2017 10:38:36 -0800 Subject: [PATCH] nfp: validate rx offset from the BAR and size down it's field NFP_NET_CFG_RX_OFFSET is 32bit wide, make sure what we read from there is reasonable for packet headroom. This allows us to store the rx_offset in a 8bit variable. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller --- drivers/net/ethernet/netronome/nfp/nfp_net.h | 6 +++--- .../net/ethernet/netronome/nfp/nfp_net_common.c | 14 +++++++++++--- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h index db92463da440..5f0547c6efb8 100644 --- a/drivers/net/ethernet/netronome/nfp/nfp_net.h +++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h @@ -439,9 +439,9 @@ struct nfp_stat_pair { * @bpf_offload_xdp: Offloaded BPF program is XDP * @chained_metadata_format: Firemware will use new metadata format * @rx_dma_dir: Mapping direction for RX buffers + * @rx_offset: Offset in the RX buffers where packet data starts * @ctrl: Local copy of the control register/word. * @fl_bufsz: Currently configured size of the freelist buffers - * @rx_offset: Offset in the RX buffers where packet data starts * @xdp_prog: Installed XDP program * @tx_rings: Array of pre-allocated TX ring structures * @rx_rings: Array of pre-allocated RX ring structures @@ -466,11 +466,11 @@ struct nfp_net_dp { u8 rx_dma_dir; + u8 rx_offset; + u32 ctrl; u32 fl_bufsz; - u32 rx_offset; - struct bpf_prog *xdp_prog; struct nfp_net_tx_ring *tx_rings; diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c index ab03f2f301cd..513f55dd746b 100644 --- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c @@ -3124,10 +3124,18 @@ int nfp_net_netdev_init(struct net_device *netdev) nfp_net_write_mac_addr(nn); /* Determine RX packet/metadata boundary offset */ - if (nn->fw_ver.major >= 2) - nn->dp.rx_offset = nn_readl(nn, NFP_NET_CFG_RX_OFFSET); - else + if (nn->fw_ver.major >= 2) { + u32 reg; + + reg = nn_readl(nn, NFP_NET_CFG_RX_OFFSET); + if (reg > NFP_NET_MAX_PREPEND) { + nn_err(nn, "Invalid rx offset: %d\n", reg); + return -EINVAL; + } + nn->dp.rx_offset = reg; + } else { nn->dp.rx_offset = NFP_NET_RX_OFFSET; + } /* Set default MTU and Freelist buffer size */ if (nn->max_mtu < NFP_NET_DEFAULT_MTU) -- 2.20.1