[PATCH v9-S2 01/13] net/dpaa2: fix integer overflow in CCSR region mapping

[Stephen Hemminger]

On Mon, 12 Oct 2026 12:34:32 +0530
Prashant Gupta <prashant.gupta_3 at nxp.com> wrote:

> From: Hemant Agrawal <hemant.agrawal at nxp.com>
> 
> In lsx_ccsr_map_region, PAGE_SIZE is a macro defined as
> sysconf(_SC_PAGESIZE), which returns a signed long and may be negative
> on error. The value was used directly in size_t comparisons and passed
> to mmap, causing an integer overflow (Coverity CID 49765682).
> 
> The old round-down "len & PAGE_MASK" ignored the in-page offset: for a
> 4096-byte or 6656-byte len on a 64K-page kernel the masked result is 0,
> causing the mapping to fail, where the old code would have bumped len up
> to PAGE_SIZE. The correct mapping size must cover the region from the
> page-aligned start through offset + len.
> 
> Fix by calling sysconf(_SC_PAGESIZE) explicitly into a signed long,
> checking for a non-positive return before use, computing page_mask from
> the verified value, and using RTE_ALIGN_CEIL(offset + len, page_size)
> for map_len so that the mmap covers the full requested region regardless
> of page size. The page-aligned start address and the back-pointer offset
> are both derived from the same page_mask, keeping the three values
> consistent.
> 
> Coverity issue: 49765682
> Fixes: f023d059769f ("net/dpaa2: support recycle loopback port")
> Cc: stable at dpdk.org
> Signed-off-by: Hemant Agrawal <hemant.agrawal at nxp.com>
> ---
>  drivers/net/dpaa2/dpaa2_recycle.c | 23 +++++++++++++++--------
>  1 file changed, 15 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/dpaa2/dpaa2_recycle.c b/drivers/net/dpaa2/dpaa2_recycle.c
> index f78d12362e..9b6ae3f515 100644
> --- a/drivers/net/dpaa2/dpaa2_recycle.c
> +++ b/drivers/net/dpaa2/dpaa2_recycle.c
> @@ -176,6 +176,9 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)
>  	void *tmp;
>  	uint64_t start;
>  	uint64_t offset;
> +	uint64_t page_mask;
> +	long page_size;
> +	size_t map_len;
>  
>  	fd = open("/dev/mem", O_RDWR);

Does this driver work with CONFIG_STRICT_DEVMEM and CONFIG_IO_STRICT_DEVMEM?
Note it won't work in lockdown mode at all.

>  	if (fd < 0) {
> @@ -183,20 +186,24 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)
>  		return NULL;
>  	}
>  
> -	start = addr & PAGE_MASK;
> +	page_size = sysconf(_SC_PAGESIZE);
> +	if (page_size <= 0) {

Something is broken if this happens, should log it?