net: ethernet: renesas: rswitch: Fix endless loop in error paths

Coverity reported that the error path in rswitch_gwca_queue_alloc_skb()
has an issue to cause endless loop. So, fix the issue by changing
variables' types from u32 to int. After changed the types,
rswitch_tx_free() should use rswitch_get_num_cur_queues() to
calculate number of current queues.

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1527147 ("Control flow issues")
Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20221107081021.2955122-1-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c
index 4f7af6393c9e7cf23765d8cc3d932057b85a3f1d..f3d27aef128695f0e2d496a2f4496c1d2a5cd6f1 100644 (file)
--- a/drivers/net/ethernet/renesas/rswitch.c
+++ b/drivers/net/ethernet/renesas/rswitch.c
@@ -219,9 +219,9 @@ static void rswitch_ack_data_irq(struct rswitch_private *priv, int index)
        iowrite32(BIT(index % 32), priv->addr + offs);
 }
 
-static u32 rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, u32 num)
+static int rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, int num)
 {
-       u32 index = cur ? gq->cur : gq->dirty;
+       int index = cur ? gq->cur : gq->dirty;
 
        if (index + num >= gq->ring_size)
                index = (index + num) % gq->ring_size;
@@ -231,7 +231,7 @@ static u32 rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, u32
        return index;
 }
 
-static u32 rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq)
+static int rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq)
 {
        if (gq->cur >= gq->dirty)
                return gq->cur - gq->dirty;
@@ -250,9 +250,9 @@ static bool rswitch_is_queue_rxed(struct rswitch_gwca_queue *gq)
 }
 
 static int rswitch_gwca_queue_alloc_skb(struct rswitch_gwca_queue *gq,
-                                       u32 start_index, u32 num)
+                                       int start_index, int num)
 {
-       u32 i, index;
+       int i, index;
 
        for (i = 0; i < num; i++) {
                index = (i + start_index) % gq->ring_size;
@@ -410,12 +410,12 @@ err:
 
 static int rswitch_gwca_queue_ts_fill(struct net_device *ndev,
                                      struct rswitch_gwca_queue *gq,
-                                     u32 start_index, u32 num)
+                                     int start_index, int num)
 {
        struct rswitch_device *rdev = netdev_priv(ndev);
        struct rswitch_ext_ts_desc *desc;
        dma_addr_t dma_addr;
-       u32 i, index;
+       int i, index;
 
        for (i = 0; i < num; i++) {
                index = (i + start_index) % gq->ring_size;
@@ -736,7 +736,8 @@ static int rswitch_tx_free(struct net_device *ndev, bool free_txed_only)
        int free_num = 0;
        int size;
 
-       for (; gq->cur - gq->dirty > 0; gq->dirty = rswitch_next_queue_index(gq, false, 1)) {
+       for (; rswitch_get_num_cur_queues(gq) > 0;
+            gq->dirty = rswitch_next_queue_index(gq, false, 1)) {
                desc = &gq->ring[gq->dirty];
                if (free_txed_only && (desc->desc.die_dt & DT_MASK) != DT_FEMPTY)
                        break;

diff --git a/drivers/net/ethernet/renesas/rswitch.h b/drivers/net/ethernet/renesas/rswitch.h
index 778177ec8d4f380227f0bfae523db92763e928c2..edbdd1b98d3d9c5261b8e0e02d7fcab1d7a90ad9 100644 (file)
--- a/drivers/net/ethernet/renesas/rswitch.h
+++ b/drivers/net/ethernet/renesas/rswitch.h
@@ -908,9 +908,9 @@ struct rswitch_gwca_queue {
                struct rswitch_ext_ts_desc *ts_ring;
        };
        dma_addr_t ring_dma;
-       u32 ring_size;
-       u32 cur;
-       u32 dirty;
+       int ring_size;
+       int cur;
+       int dirty;
        struct sk_buff **skbs;
 
        struct net_device *ndev;        /* queue to ndev for irq */