nfp: use kvcalloc() to allocate SW buffer descriptor arrays

Use kvcalloc() instead of tmp variable + kzalloc() when allocating
SW buffer information to allow falling back to vmalloc and to protect
from theoretical integer overflow.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index cf1704e..d02baef 100644 (file)
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -53,6 +53,7 @@
 #include <linux/interrupt.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
+#include <linux/mm.h>
 #include <linux/page_ref.h>
 #include <linux/pci.h>
 #include <linux/pci_regs.h>
@@ -2126,7 +2127,7 @@ static void nfp_net_tx_ring_free(struct nfp_net_tx_ring *tx_ring)
        struct nfp_net_r_vector *r_vec = tx_ring->r_vec;
        struct nfp_net_dp *dp = &r_vec->nfp_net->dp;
 
-       kfree(tx_ring->txbufs);
+       kvfree(tx_ring->txbufs);
 
        if (tx_ring->txds)
                dma_free_coherent(dp->dev, tx_ring->size,
@@ -2150,7 +2151,6 @@ static int
 nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
 {
        struct nfp_net_r_vector *r_vec = tx_ring->r_vec;
-       int sz;
 
        tx_ring->cnt = dp->txd_cnt;
 
@@ -2160,8 +2160,8 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
        if (!tx_ring->txds)
                goto err_alloc;
 
-       sz = sizeof(*tx_ring->txbufs) * tx_ring->cnt;
-       tx_ring->txbufs = kzalloc(sz, GFP_KERNEL);
+       tx_ring->txbufs = kvcalloc(tx_ring->cnt, sizeof(*tx_ring->txbufs),
+                                  GFP_KERNEL);
        if (!tx_ring->txbufs)
                goto err_alloc;
 
@@ -2275,7 +2275,7 @@ static void nfp_net_rx_ring_free(struct nfp_net_rx_ring *rx_ring)
 
        if (dp->netdev)
                xdp_rxq_info_unreg(&rx_ring->xdp_rxq);
-       kfree(rx_ring->rxbufs);
+       kvfree(rx_ring->rxbufs);
 
        if (rx_ring->rxds)
                dma_free_coherent(dp->dev, rx_ring->size,
@@ -2298,7 +2298,7 @@ static void nfp_net_rx_ring_free(struct nfp_net_rx_ring *rx_ring)
 static int
 nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)
 {
-       int sz, err;
+       int err;
 
        if (dp->netdev) {
                err = xdp_rxq_info_reg(&rx_ring->xdp_rxq, dp->netdev,
@@ -2314,8 +2314,8 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)
        if (!rx_ring->rxds)
                goto err_alloc;
 
-       sz = sizeof(*rx_ring->rxbufs) * rx_ring->cnt;
-       rx_ring->rxbufs = kzalloc(sz, GFP_KERNEL);
+       rx_ring->rxbufs = kvcalloc(rx_ring->cnt, sizeof(*rx_ring->rxbufs),
+                                  GFP_KERNEL);
        if (!rx_ring->rxbufs)
                goto err_alloc;