Commit 4078c561 authored by Alexey Kodanev's avatar Alexey Kodanev Committed by Jakub Kicinski
Browse files

nfp: fix swapped arguments in nfp_encode_basic_qdr() calls 



There is a mismatch between the passed arguments and the actual
nfp_encode_basic_qdr() function parameter names:

  static int nfp_encode_basic_qdr(u64 addr, int dest_island, int cpp_tgt,
                                  int mode, bool addr40, int isld1,
                                  int isld0)
  {
      ...

But "dest_island" and "cpp_tgt" are swapped at every call-site.
For example:

  return nfp_encode_basic_qdr(*addr, cpp_tgt, dest_island,
                              mode, addr40, isld1, isld0);

As a result, nfp_encode_basic_qdr() receives "dest_island" as CPP target
type, which is always NFP_CPP_TARGET_QDR(2) for these calls, and "cpp_tgt"
as the destination island ID, which can accidentally match or be outside
the valid NFP_CPP_TARGET_* types (e.g. '-1' for any destination).

Since code already worked for years, also add extra pr_warn() to error
paths in nfp_encode_basic_qdr() to help identify any potential address
verification failures.

Detected using the static analysis tool - Svace.

Fixes: 4cb584e0 ("nfp: add CPP access core")
Signed-off-by: default avatarAlexey Kodanev <aleksei.kodanev@bell-sw.com>
Link: https://patch.msgid.link/20260422160536.61855-1-aleksei.kodanev@bell-sw.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 5a8db80f

drivers/net/ethernet/netronome/nfp/nfpcore/nfp_target.c

+11 −6
Original line number Diff line number Diff line
@@ -435,12 +435,17 @@ static int nfp_encode_basic_qdr(u64 addr, int dest_island, int cpp_tgt, 


	/* Full Island ID and channel bits overlap? */

	ret = nfp_decode_basic(addr, &v, cpp_tgt, mode, addr40, isld1, isld0);

	if (ret)

	if (ret) {

		pr_warn("%s: decode dest_island failed: %d\n", __func__, ret);

		return ret;

	}



	/* The current address won't go where expected? */

	if (dest_island != -1 && dest_island != v)

	if (dest_island != -1 && dest_island != v) {

		pr_warn("%s: dest_island mismatch: current (%d) != decoded (%d)\n",

			__func__, dest_island, v);

		return -EINVAL;

	}



	/* If dest_island was -1, we don't care where it goes. */

	return 0;
@@ -493,7 +498,7 @@ static int nfp_encode_basic(u64 *addr, int dest_island, int cpp_tgt, 
			 * the address but we can verify if the existing

			 * contents will point to a valid island.

			 */

			return nfp_encode_basic_qdr(*addr, cpp_tgt, dest_island,

			return nfp_encode_basic_qdr(*addr, dest_island, cpp_tgt,

						    mode, addr40, isld1, isld0);



		iid_lsb = addr40 ? 34 : 26;
@@ -504,7 +509,7 @@ static int nfp_encode_basic(u64 *addr, int dest_island, int cpp_tgt, 
		return 0;

	case 1:

		if (cpp_tgt == NFP_CPP_TARGET_QDR && !addr40)

			return nfp_encode_basic_qdr(*addr, cpp_tgt, dest_island,

			return nfp_encode_basic_qdr(*addr, dest_island, cpp_tgt,

						    mode, addr40, isld1, isld0);



		idx_lsb = addr40 ? 39 : 31;
@@ -530,7 +535,7 @@ static int nfp_encode_basic(u64 *addr, int dest_island, int cpp_tgt, 
			 * be set before hand and with them select an island.

			 * So we need to confirm that it's at least plausible.

			 */

			return nfp_encode_basic_qdr(*addr, cpp_tgt, dest_island,

			return nfp_encode_basic_qdr(*addr, dest_island, cpp_tgt,

						    mode, addr40, isld1, isld0);



		/* Make sure we compare against isldN values
@@ -551,7 +556,7 @@ static int nfp_encode_basic(u64 *addr, int dest_island, int cpp_tgt, 
			 * iid<1> = addr<30> = channel<0>

			 * channel<1> = addr<31> = Index

			 */

			return nfp_encode_basic_qdr(*addr, cpp_tgt, dest_island,

			return nfp_encode_basic_qdr(*addr, dest_island, cpp_tgt,

						    mode, addr40, isld1, isld0);



		isld[0] &= ~3;