On Mon, 12 Oct 2026 12:34:32 +0530 Prashant Gupta <[email protected]> wrote:
> From: Hemant Agrawal <[email protected]> > > In lsx_ccsr_map_region, PAGE_SIZE is a macro defined as > sysconf(_SC_PAGESIZE), which returns a signed long and may be negative > on error. The value was used directly in size_t comparisons and passed > to mmap, causing an integer overflow (Coverity CID 49765682). > > The old round-down "len & PAGE_MASK" ignored the in-page offset: for a > 4096-byte or 6656-byte len on a 64K-page kernel the masked result is 0, > causing the mapping to fail, where the old code would have bumped len up > to PAGE_SIZE. The correct mapping size must cover the region from the > page-aligned start through offset + len. > > Fix by calling sysconf(_SC_PAGESIZE) explicitly into a signed long, > checking for a non-positive return before use, computing page_mask from > the verified value, and using RTE_ALIGN_CEIL(offset + len, page_size) > for map_len so that the mmap covers the full requested region regardless > of page size. The page-aligned start address and the back-pointer offset > are both derived from the same page_mask, keeping the three values > consistent. > > Coverity issue: 49765682 > Fixes: f023d059769f ("net/dpaa2: support recycle loopback port") > Cc: [email protected] > Signed-off-by: Hemant Agrawal <[email protected]> > --- > drivers/net/dpaa2/dpaa2_recycle.c | 23 +++++++++++++++-------- > 1 file changed, 15 insertions(+), 8 deletions(-) > > diff --git a/drivers/net/dpaa2/dpaa2_recycle.c > b/drivers/net/dpaa2/dpaa2_recycle.c > index f78d12362e..9b6ae3f515 100644 > --- a/drivers/net/dpaa2/dpaa2_recycle.c > +++ b/drivers/net/dpaa2/dpaa2_recycle.c > @@ -176,6 +176,9 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t > len) > void *tmp; > uint64_t start; > uint64_t offset; > + uint64_t page_mask; > + long page_size; > + size_t map_len; > > fd = open("/dev/mem", O_RDWR); Does this driver work with CONFIG_STRICT_DEVMEM and CONFIG_IO_STRICT_DEVMEM? Note it won't work in lockdown mode at all. > if (fd < 0) { > @@ -183,20 +186,24 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t > len) > return NULL; > } > > - start = addr & PAGE_MASK; > + page_size = sysconf(_SC_PAGESIZE); > + if (page_size <= 0) { Something is broken if this happens, should log it?
