net/ring: check internal arguments

[dpdk.git] / drivers / net / netvsc / hn_rxtx.c

diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
index a388ff2..5d59db5 100644 (file)
--- a/drivers/net/netvsc/hn_rxtx.c
+++ b/drivers/net/netvsc/hn_rxtx.c
@@ -160,8 +160,8 @@ static void hn_txd_init(struct rte_mempool *mp __rte_unused,
 
        txd->queue_id = txq->queue_id;
        txd->chim_index = NVS_CHIM_IDX_INVALID;
-       txd->rndis_pkt = (struct rndis_packet_msg *)(char *)txq->tx_rndis
-               + idx * HN_RNDIS_PKT_ALIGNED;
+       txd->rndis_pkt = (struct rndis_packet_msg *)((char *)txq->tx_rndis
+               + idx * HN_RNDIS_PKT_ALIGNED);
 }
 
 int
@@ -252,16 +252,6 @@ hn_dev_tx_queue_setup(struct rte_eth_dev *dev,
 
        PMD_INIT_FUNC_TRACE();
 
-       txq = rte_zmalloc_socket("HN_TXQ", sizeof(*txq), RTE_CACHE_LINE_SIZE,
-                                socket_id);
-       if (!txq)
-               return -ENOMEM;
-
-       txq->hv = hv;
-       txq->chan = hv->channels[queue_idx];
-       txq->port_id = dev->data->port_id;
-       txq->queue_id = queue_idx;
-
        tx_free_thresh = tx_conf->tx_free_thresh;
        if (tx_free_thresh == 0)
                tx_free_thresh = RTE_MIN(nb_desc / 4,
@@ -276,6 +266,15 @@ hn_dev_tx_queue_setup(struct rte_eth_dev *dev,
                return -EINVAL;
        }
 
+       txq = rte_zmalloc_socket("HN_TXQ", sizeof(*txq), RTE_CACHE_LINE_SIZE,
+                                socket_id);
+       if (!txq)
+               return -ENOMEM;
+
+       txq->hv = hv;
+       txq->chan = hv->channels[queue_idx];
+       txq->port_id = dev->data->port_id;
+       txq->queue_id = queue_idx;
        txq->free_thresh = tx_free_thresh;
 
        snprintf(name, sizeof(name),
@@ -666,7 +665,8 @@ static void hn_rndis_rx_data(struct hn_rx_queue *rxq,
                             struct hn_rx_bufinfo *rxb,
                             void *data, uint32_t dlen)
 {
-       unsigned int data_off, data_len, pktinfo_off, pktinfo_len;
+       unsigned int data_off, data_len;
+       unsigned int pktinfo_off, pktinfo_len;
        const struct rndis_packet_msg *pkt = data;
        struct hn_rxinfo info = {
                .vlan_info = HN_NDIS_VLAN_INFO_INVALID,
@@ -711,7 +711,8 @@ static void hn_rndis_rx_data(struct hn_rx_queue *rxq,
                        goto error;
        }
 
-       if (unlikely(data_off + data_len > pkt->len))
+       /* overflow check */
+       if (data_len > data_len + data_off || data_len + data_off > pkt->len)
                goto error;
 
        if (unlikely(data_len < RTE_ETHER_HDR_LEN))