Skip to content

Commit

Permalink
cxgb4: Fix unintentional sign extension issues
Browse files Browse the repository at this point in the history
The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to
the left will be promoted to a 32 bit signed int and then
sign-extended to a u64. In the event that the top bit of the u8
is set then all then all the upper 32 bits of the u64 end up as
also being set because of the sign-extension. Fix this by
casting the u8 values to a u64 before the 24 bit left shift.

Addresses-Coverity: ("Unintended sign extension")
Fixes: 12b276f ("cxgb4: add support to create hash filters")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Colin Ian King authored and David S. Miller committed Apr 12, 2021
1 parent 5b489fe commit dd2c796
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
Original file line number Diff line number Diff line change
Expand Up @@ -174,31 +174,31 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
WORD_MASK, f->fs.nat_lip[15] |
f->fs.nat_lip[14] << 8 |
f->fs.nat_lip[13] << 16 |
f->fs.nat_lip[12] << 24, 1);
(u64)f->fs.nat_lip[12] << 24, 1);

set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 1,
WORD_MASK, f->fs.nat_lip[11] |
f->fs.nat_lip[10] << 8 |
f->fs.nat_lip[9] << 16 |
f->fs.nat_lip[8] << 24, 1);
(u64)f->fs.nat_lip[8] << 24, 1);

set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 2,
WORD_MASK, f->fs.nat_lip[7] |
f->fs.nat_lip[6] << 8 |
f->fs.nat_lip[5] << 16 |
f->fs.nat_lip[4] << 24, 1);
(u64)f->fs.nat_lip[4] << 24, 1);

set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 3,
WORD_MASK, f->fs.nat_lip[3] |
f->fs.nat_lip[2] << 8 |
f->fs.nat_lip[1] << 16 |
f->fs.nat_lip[0] << 24, 1);
(u64)f->fs.nat_lip[0] << 24, 1);
} else {
set_tcb_field(adap, f, tid, TCB_RX_FRAG3_LEN_RAW_W,
WORD_MASK, f->fs.nat_lip[3] |
f->fs.nat_lip[2] << 8 |
f->fs.nat_lip[1] << 16 |
f->fs.nat_lip[0] << 24, 1);
(u64)f->fs.nat_lip[0] << 25, 1);
}
}

Expand All @@ -208,39 +208,39 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
WORD_MASK, f->fs.nat_fip[15] |
f->fs.nat_fip[14] << 8 |
f->fs.nat_fip[13] << 16 |
f->fs.nat_fip[12] << 24, 1);
(u64)f->fs.nat_fip[12] << 24, 1);

set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 1,
WORD_MASK, f->fs.nat_fip[11] |
f->fs.nat_fip[10] << 8 |
f->fs.nat_fip[9] << 16 |
f->fs.nat_fip[8] << 24, 1);
(u64)f->fs.nat_fip[8] << 24, 1);

set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 2,
WORD_MASK, f->fs.nat_fip[7] |
f->fs.nat_fip[6] << 8 |
f->fs.nat_fip[5] << 16 |
f->fs.nat_fip[4] << 24, 1);
(u64)f->fs.nat_fip[4] << 24, 1);

set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 3,
WORD_MASK, f->fs.nat_fip[3] |
f->fs.nat_fip[2] << 8 |
f->fs.nat_fip[1] << 16 |
f->fs.nat_fip[0] << 24, 1);
(u64)f->fs.nat_fip[0] << 24, 1);

} else {
set_tcb_field(adap, f, tid,
TCB_RX_FRAG3_START_IDX_OFFSET_RAW_W,
WORD_MASK, f->fs.nat_fip[3] |
f->fs.nat_fip[2] << 8 |
f->fs.nat_fip[1] << 16 |
f->fs.nat_fip[0] << 24, 1);
(u64)f->fs.nat_fip[0] << 24, 1);
}
}

set_tcb_field(adap, f, tid, TCB_PDU_HDR_LEN_W, WORD_MASK,
(dp ? (nat_lp[1] | nat_lp[0] << 8) : 0) |
(sp ? (nat_fp[1] << 16 | nat_fp[0] << 24) : 0),
(sp ? (nat_fp[1] << 16 | (u64)nat_fp[0] << 24) : 0),
1);
}

Expand Down

0 comments on commit dd2c796

Please sign in to comment.