[PATCH v4-S2 01/13] net/dpaa2: fix integer overflow in CCSR region mapping

[Prashant Gupta]

From: Hemant Agrawal <hemant.agra...@nxp.com>

In lsx_ccsr_map_region, PAGE_SIZE is defined as sysconf(_SC_PAGESIZE)
which may be negative on error. The value was used directly in size_t
comparisons and passed to mmap, causing an integer overflow (Coverity
CID 49765682).

Use sysconf() explicitly with a signed long, check for errors, and
compute map_len separately with unsigned arithmetic before passing to
mmap.

Coverity issue: 49765682
Fixes: f023d059769f ("net/dpaa2: support recycle loopback port")
Cc: sta...@dpdk.org
Signed-off-by: Hemant Agrawal <hemant.agra...@nxp.com>
---
 drivers/net/dpaa2/dpaa2_recycle.c | 39 ++++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_recycle.c 
b/drivers/net/dpaa2/dpaa2_recycle.c
index f78d12362e..ef7caa5f19 100644
--- a/drivers/net/dpaa2/dpaa2_recycle.c
+++ b/drivers/net/dpaa2/dpaa2_recycle.c
@@ -30,11 +30,6 @@
 #include <unistd.h>
 #include <sys/mman.h>
 
-#ifndef PAGE_SIZE
-#define PAGE_SIZE                      (sysconf(_SC_PAGESIZE))
-#endif
-#define PAGE_MASK                      (~(PAGE_SIZE - 1))
-
 #define LSX_SERDES_LAN_NB              8
 #define LSX_SERDES_REG_BASE            0x1ea0000
 #define LSX_LB_EN_BIT                  0x10000000
@@ -176,6 +171,9 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)
        void *tmp;
        uint64_t start;
        uint64_t offset;
+       uint64_t page_mask;
+       long page_size;
+       size_t map_len;
 
        fd = open("/dev/mem", O_RDWR);
        if (fd < 0) {
@@ -183,20 +181,35 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t 
len)
                return NULL;
        }
 
-       start = addr & PAGE_MASK;
+       page_size = sysconf(_SC_PAGESIZE);
+       if (page_size <= 0) {
+               close(fd);
+               return NULL;
+       }
+       page_mask = ~((uint64_t)page_size - 1);
+       start = addr & page_mask;
        offset = addr - start;
-       len = len & PAGE_MASK;
-       if (len < (size_t)PAGE_SIZE)
-               len = PAGE_SIZE;
+       len = len & page_mask;
+       if (len == 0) {
+               close(fd);
+               return NULL;
+       }
 
-       tmp = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, start);
+       map_len = len;
+       if (map_len < (size_t)page_size)
+               map_len = (size_t)page_size;
+
+       tmp = mmap(NULL, map_len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 
start);
 
        close(fd);
 
-       if (tmp != MAP_FAILED)
-               return (uint8_t *)tmp + offset;
-       else
+       if (tmp == MAP_FAILED) {
+               DPAA2_PMD_ERR("mmap 0x%" PRIx64 "(size=0x%zx) failed",
+                       addr, map_len);
                return NULL;
+       }
+
+       return (uint8_t *)tmp + offset;
 }
 
 static const uint8_t ls_sd1_prot_idx_map[] = {
-- 
2.43.0