net: hns3: fix bugs found by codereview

driver inclusion
category: bugfix
bugzilla: NA
CVE: NA

---------------------------------

This patch clears bugs found by codereview.
Signed-off-by: NJunxin Chen <chenjunxin1@huawei.com>
Reviewed-by: NZhong Zhaohui <zhongzhaohui@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: NXie XiuQi <xiexiuqi@huawei.com>

drivers/net/ethernet/hisilicon/hns3/hnae3.h

@@ -30,7 +30,7 @@
 #include <linux/pci.h>
 #include <linux/types.h>
 
-#define HNAE3_MOD_VERSION "1.9.29.0"
+#define HNAE3_MOD_VERSION "1.9.30.0"
 
 #define HNAE3_MIN_VECTOR_NUM	2 /* one for msi-x, another for IO */
 

drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3pf/hclge_ext.c

@@ -283,7 +283,7 @@ static int hclge_get_led_signal(struct hnae3_handle *handle, int opcode,
 	ret = hclge_cmd_send(&hdev->hw, &desc, 1);
 	if (ret) {
 		dev_err(&hdev->pdev->dev,
-			"hclge_get_sgpio_tx_reg failed %d\n", ret);
+			"hclge get led signal failed %d\n", ret);
 		return ret;
 	}
 
@@ -349,7 +349,7 @@ static int hclge_get_net_lane_status(struct hnae3_handle *handle, int opcode,
 	hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_DISABLE_NET_LANE, true);
 	ret = hclge_cmd_send(&hdev->hw, &desc, 1);
 	if (ret) {
-		dev_err(&hdev->pdev->dev, "disable net lane failed %d\n", ret);
+		dev_err(&hdev->pdev->dev, "get lane status failed %d\n", ret);
 		return ret;
 	}
 	*status = desc.data[0];
@@ -521,12 +521,12 @@ static int hclge_check_phy_opt_param(struct hclge_dev *hdev,
 				     enum hclge_phy_op_code opt_type)
 {
 	if (!phydev) {
-		dev_err(&hdev->pdev->dev, "this net dev has no phy.\n");
+		dev_err(&hdev->pdev->dev, "this net dev has no phy.");
 		return -EINVAL;
 	}
 
 	if (!mdio_bus) {
-		dev_err(&hdev->pdev->dev, "this net dev has no mdio bus.\n");
+		dev_err(&hdev->pdev->dev, "this net dev has no mdio bus.");
 		return -EINVAL;
 	}
 
@@ -550,7 +550,7 @@ static int hclge_mdio_bus_opt(struct hclge_phy_para *para,
 		op_ret = mdio_bus->read(mdio_bus, phyid, para->reg_addr);
 		if (op_ret < 0) {
 			dev_err(&hdev->pdev->dev,
-				"read phy %d page %d reg %d failed.\n",
+				"read phy %u page %d reg %d failed.\n",
 				phyid, para->page, para->reg_addr);
 		} else {
 			para->data = (u16)op_ret;
@@ -561,7 +561,7 @@ static int hclge_mdio_bus_opt(struct hclge_phy_para *para,
 					 para->data);
 		if (op_ret < 0) {
 			dev_err(&hdev->pdev->dev,
-				"write phy %d page %d reg %d failed.\n",
+				"write phy %u page %d reg %d failed.\n",
 				phyid, para->page, para->reg_addr);
 		}
 	}

drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_cmd.c

@@ -157,7 +157,7 @@ void hns3_cae_cmd_setup_basic_desc(struct hclge_desc *desc,
 
 /**
  * hns3_cae_cmd_send - send command to command queue
- * @h: pointer to the hnae3_handle
+ * @hdev: pointer to the hclge_dev
  * @desc: prefilled descriptor for describing the command
  * @num : the number of descriptors to be sent
  *

drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c

@@ -156,11 +156,11 @@ static int hns3_cae_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in,
 {
 #define HNS3_CAE_FD_TCAM_BD_NUM		3
 	struct fd_param *param = (struct fd_param *)buf_in;
+	struct hclge_desc desc[HNS3_CAE_FD_TCAM_BD_NUM];
 	struct hclge_fd_tcam_config_1_cmd *req1;
 	struct hclge_fd_tcam_config_2_cmd *req2;
 	struct hclge_fd_tcam_config_3_cmd *req3;
 	struct hclge_fd_tcam_data *tcam_data;
-	struct hclge_desc desc[3];
 	struct hclge_desc *pdesc;
 	bool check;
 	u8 *buf;

drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c

@@ -420,12 +420,21 @@ static ssize_t hns3_cae_k_write(struct file *pfile, const char __user *ubuf,
 
 static int hns3_cae_k_mmap(struct file *filp, struct vm_area_struct *vma)
 {
+	phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+	size_t size = vma->vm_end - vma->vm_start;
 	int ret;
 
 	vma->vm_flags |= VM_IO;
 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+
+	if (offset + (phys_addr_t)size - 1 < offset)
+		return -EINVAL;
+
+	if (offset >> PAGE_SHIFT != vma->vm_pgoff)
+		return -EINVAL;
+
 	ret = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-			      vma->vm_end - vma->vm_start, vma->vm_page_prot);
+			      size, vma->vm_page_prot);
 	if (ret)
 		return -EIO;
 

drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pkt.c

@@ -239,12 +239,17 @@ static struct sk_buff *__hns_assemble_skb(struct net_device *ndev,
 {
 	const struct ethhdr *ethhead = (const struct ethhdr *)data;
 	const char *head_data = (const char *)data;
+	struct sk_buff *skb = NULL;
 	struct page *p = NULL;
-	struct sk_buff *skb;
 	void *buff = NULL;
 	int proc_length;
 	int bnum = 0;
 
+	if (mss <= 0) {
+		pr_err("mss(=%d) of packet is invalid\n", mss);
+		return NULL;
+	}
+
 	/* allocate test skb */
 	skb = alloc_skb(256, GFP_KERNEL);
 	if (!skb)
@@ -409,8 +414,15 @@ void __fill_the_pkt_head(struct net_device *netdev, u8 *payload,
 				       58);
 		break;
 	case HNS3_CAE_PKT_TYPE_IPV4_TRACEROUTE_OPTION:
+		if (in_info->pkt_len < IPV4_TRACEROUTE_PKT_LEN) {
+			dev_err(&netdev->dev,
+				"pkt_len(=%d) of ipv4 trace route pkt must big than %d.\n",
+				in_info->pkt_len, IPV4_TRACEROUTE_PKT_LEN);
+			return;
+		}
+
 		hns3_cae_pkt_type_deal(payload, in_info, ifa_list, pkt_payload,
-				       66);
+				       IPV4_TRACEROUTE_PKT_LEN);
 		break;
 	case HNS3_CAE_PKT_TYPE_IPV6:
 		memcpy(payload, in_info->dst_mac, ETH_ALEN);
@@ -420,11 +432,17 @@ void __fill_the_pkt_head(struct net_device *netdev, u8 *payload,
 				       54);
 		break;
 	case HNS3_CAE_PKT_TYPE_IPV6_EXTENSION_ROUTING:
+		if (in_info->pkt_len < IPV6_EXTENSION_PKT_LEN) {
+			dev_err(&netdev->dev,
+				"pkt_len(=%d) of ipv6 extension pkt must big than %d.\n",
+				in_info->pkt_len, IPV6_EXTENSION_PKT_LEN);
+			return;
+		}
 		memcpy(payload, in_info->dst_mac, ETH_ALEN);
 		memcpy(payload + 22, in_info->pkt_inet6_addr, 16);
 
 		hns3_cae_pkt_type_deal(payload, in_info, ifa_list, pkt_payload,
-				       114);
+				       IPV6_EXTENSION_PKT_LEN);
 		break;
 	case HNS3_CAE_PKT_TYPE_SCTP4:
 		memcpy(payload, in_info->dst_mac, ETH_ALEN);
@@ -492,8 +510,9 @@ int __hns3_cae_send_pkt(struct hns3_nic_priv *net_priv,
 	struct net_device *netdev = net_priv->netdev;
 
 	handle = net_priv->ae_handle;
-	if (queue_id > handle->kinfo.num_tqps ||
-	    queue_id + in_info->multi_queue - 1 > handle->kinfo.num_tqps) {
+	if (queue_id >= handle->kinfo.num_tqps ||
+	    queue_id + in_info->multi_queue - 1 >= handle->kinfo.num_tqps ||
+	    queue_id < 0) {
 		pr_err("%s,%d:queue(%d) or multi_queue(%d) is invalid\n",
 		       __func__, __LINE__,
 		       in_info->queue_id, in_info->multi_queue);
@@ -501,6 +520,10 @@ int __hns3_cae_send_pkt(struct hns3_nic_priv *net_priv,
 	}
 
 	pkt_len = in_info->pkt_len;
+	if (pkt_len < MIN_PKT_LEN) {
+		dev_err(&netdev->dev, "pkt_len(=%d) is invalid\n", pkt_len);
+		return -EINVAL;
+	}
 
 	payload = kzalloc(pkt_len, GFP_KERNEL);
 	if (ZERO_OR_NULL_PTR(payload))
@@ -643,8 +666,8 @@ int hns3_cae_create_new_thread(int tid,
 
 	memcpy(kthread_table[tid]->in_info, in_info, sizeof(*in_info));
 
-	name[13] = tid / 10 + '0';
-	name[14] = tid % 10 + '0';
+	name[strlen(name) - 2] = tid / 10 + '0';
+	name[strlen(name) - 1] = tid % 10 + '0';
 	kthread_table[tid]->task =
 	    kthread_run(__hns3_cae_new_task, kthread_table[tid], "%s", name);
 	if (IS_ERR(kthread_table[tid]->task)) {
@@ -697,7 +720,7 @@ int hns3_cae_send_pkt(struct hns3_nic_priv *net_priv,
 
 	handle = net_priv->ae_handle;
 	queue_id = in_info->queue_id;
-	if (queue_id > handle->kinfo.num_tqps) {
+	if (queue_id >= handle->kinfo.num_tqps || queue_id < 0) {
 		pr_err("%s,%d:queue(%d) is invalid\n", __func__, __LINE__,
 		       in_info->queue_id);
 		return -EINVAL;

drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pkt.h

@@ -8,6 +8,9 @@
 
 #define IP_ADDR_LEN	4
 #define IP6_ADDR_LEN	10
+#define MIN_PKT_LEN	64
+#define IPV4_TRACEROUTE_PKT_LEN	66
+#define IPV6_EXTENSION_PKT_LEN	114
 
 enum PKT_TYPE {
 	HNS3_CAE_PKT_TYPE_ARP = 0,

drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qinfo.c

@@ -127,7 +127,7 @@ int hns3_cae_qinfo_cfg(struct hns3_nic_priv *net_priv,
 	out_info = (struct qinfo_param *)buf_out;
 	ring_id = *((int *)buf_in);
 
-	if (ring_id > tqps_num || ring_id < 0) {
+	if (ring_id >= tqps_num || ring_id < 0) {
 		pr_err("please input valid qid\n");
 		return -1;
 	}

drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h

@@ -4,7 +4,7 @@
 #ifndef __HNS3_CAE_VERSION_H__
 #define __HNS3_CAE_VERSION_H__
 
-#define HNS3_CAE_MOD_VERSION "1.9.29.0"
+#define HNS3_CAE_MOD_VERSION "1.9.30.0"
 
 #define CMT_ID_LEN 8
 #define RESV_LEN 3

drivers/net/ethernet/hisilicon/hns3/hns3_enet.h

@@ -8,7 +8,7 @@
 
 #include "hnae3.h"
 
-#define HNS3_MOD_VERSION "1.9.29.0"
+#define HNS3_MOD_VERSION "1.9.30.0"
 
 extern char hns3_driver_version[];
 

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h

@@ -12,7 +12,7 @@
 #include "hclge_cmd.h"
 #include "hnae3.h"
 
-#define HCLGE_MOD_VERSION "1.9.29.0"
+#define HCLGE_MOD_VERSION "1.9.30.0"
 #define HCLGE_DRIVER_NAME "hclge"
 
 #define HCLGE_MAX_PF_NUM		8

drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h

@@ -10,7 +10,7 @@
 #include "hclgevf_cmd.h"
 #include "hnae3.h"
 
-#define HCLGEVF_MOD_VERSION "1.9.29.0"
+#define HCLGEVF_MOD_VERSION "1.9.30.0"
 #define HCLGEVF_DRIVER_NAME "hclgevf"
 
 #define HCLGEVF_MAX_VLAN_ID	4095