Skip to content

Commit 29b8e13

Browse files
Erick Archerrleon
authored andcommitted
RDMA/mana_ib: Prefer struct_size over open coded arithmetic
This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1][2]. As the "req" variable is a pointer to "struct mana_cfg_rx_steer_req_v2" and this structure ends in a flexible array: struct mana_cfg_rx_steer_req_v2 { [...] mana_handle_t indir_tab[] __counted_by(num_indir_entries); }; the preferred way in the kernel is to use the struct_size() helper to do the arithmetic instead of the calculation "size + size * count" in the kzalloc() function. Moreover, use the "offsetof" helper to get the indirect table offset instead of the "sizeof" operator and avoid the open-coded arithmetic in pointers using the new flex member. This new structure member also allow us to remove the "req_indir_tab" variable since it is no longer needed. This way, the code is more readable and safer. This code was detected with the help of Coccinelle, and audited and modified manually. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments [1] Link: KSPP/linux#160 [2] Signed-off-by: Erick Archer <erick.archer@outlook.com> Link: https://lore.kernel.org/r/AS8PR02MB72375EB06EE1A84A67BE722E8B022@AS8PR02MB7237.eurprd02.prod.outlook.com Reviewed-by: Long Li <longli@microsoft.com> Reviewed-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
1 parent bfec4e1 commit 29b8e13

File tree

1 file changed

+5
-7
lines changed
  • drivers/infiniband/hw/mana

1 file changed

+5
-7
lines changed

drivers/infiniband/hw/mana/qp.c

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,13 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
1515
struct mana_port_context *mpc = netdev_priv(ndev);
1616
struct mana_cfg_rx_steer_req_v2 *req;
1717
struct mana_cfg_rx_steer_resp resp = {};
18-
mana_handle_t *req_indir_tab;
1918
struct gdma_context *gc;
2019
u32 req_buf_size;
2120
int i, err;
2221

2322
gc = mdev_to_gc(dev);
2423

25-
req_buf_size =
26-
sizeof(*req) + sizeof(mana_handle_t) * MANA_INDIRECT_TABLE_SIZE;
24+
req_buf_size = struct_size(req, indir_tab, MANA_INDIRECT_TABLE_SIZE);
2725
req = kzalloc(req_buf_size, GFP_KERNEL);
2826
if (!req)
2927
return -ENOMEM;
@@ -44,20 +42,20 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
4442
req->rss_enable = true;
4543

4644
req->num_indir_entries = MANA_INDIRECT_TABLE_SIZE;
47-
req->indir_tab_offset = sizeof(*req);
45+
req->indir_tab_offset = offsetof(struct mana_cfg_rx_steer_req_v2,
46+
indir_tab);
4847
req->update_indir_tab = true;
4948
req->cqe_coalescing_enable = 1;
5049

51-
req_indir_tab = (mana_handle_t *)(req + 1);
5250
/* The ind table passed to the hardware must have
5351
* MANA_INDIRECT_TABLE_SIZE entries. Adjust the verb
5452
* ind_table to MANA_INDIRECT_TABLE_SIZE if required
5553
*/
5654
ibdev_dbg(&dev->ib_dev, "ind table size %u\n", 1 << log_ind_tbl_size);
5755
for (i = 0; i < MANA_INDIRECT_TABLE_SIZE; i++) {
58-
req_indir_tab[i] = ind_table[i % (1 << log_ind_tbl_size)];
56+
req->indir_tab[i] = ind_table[i % (1 << log_ind_tbl_size)];
5957
ibdev_dbg(&dev->ib_dev, "index %u handle 0x%llx\n", i,
60-
req_indir_tab[i]);
58+
req->indir_tab[i]);
6159
}
6260

6361
req->update_hashkey = true;

0 commit comments

Comments
 (0)