diff options
| author | Mohsin Bashir <mohsin.bashr@gmail.com> | 2025-11-25 13:17:04 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-12-07 06:27:32 +0900 |
| commit | 6f4fc4e4f47f36b651e57d788e32b6b382808e4c (patch) | |
| tree | 5ae2daaa4df26cd1a1fd948e84e5665fb9364d4f /drivers/net | |
| parent | 840cb877f3a5cc2a5c4a48c2b99d9d0c4cd97670 (diff) | |
| download | linux-6f4fc4e4f47f36b651e57d788e32b6b382808e4c.tar.gz linux-6f4fc4e4f47f36b651e57d788e32b6b382808e4c.tar.bz2 linux-6f4fc4e4f47f36b651e57d788e32b6b382808e4c.zip | |
eth: fbnic: Fix counter roll-over issue
[ Upstream commit 6d66e093e0740d39a36ef742c60eec247df26f41 ]
Fix a potential counter roll-over issue in fbnic_mbx_alloc_rx_msgs()
when calculating descriptor slots. The issue occurs when head - tail
results in a large positive value (unsigned) and the compiler interprets
head - tail - 1 as a signed value.
Since FBNIC_IPC_MBX_DESC_LEN is a power of two, use a masking operation,
which is a common way of avoiding this problem when dealing with these
sort of ring space calculations.
Fixes: da3cde08209e ("eth: fbnic: Add FW communication mechanism")
Signed-off-by: Mohsin Bashir <mohsin.bashr@gmail.com>
Link: https://patch.msgid.link/20251125211704.3222413-1-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/ethernet/meta/fbnic/fbnic_fw.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_fw.c b/drivers/net/ethernet/meta/fbnic/fbnic_fw.c index 0c55be7d2547..acc1ad91b0c3 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_fw.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_fw.c @@ -201,7 +201,7 @@ static int fbnic_mbx_alloc_rx_msgs(struct fbnic_dev *fbd) return -ENODEV; /* Fill all but 1 unused descriptors in the Rx queue. */ - count = (head - tail - 1) % FBNIC_IPC_MBX_DESC_LEN; + count = (head - tail - 1) & (FBNIC_IPC_MBX_DESC_LEN - 1); while (!err && count--) { struct fbnic_tlv_msg *msg; |