From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 992BEA0C48; Wed, 16 Jun 2021 08:08:16 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 0978F40140; Wed, 16 Jun 2021 08:08:16 +0200 (CEST) Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) by mails.dpdk.org (Postfix) with ESMTP id 3A7DE40140 for ; Tue, 15 Jun 2021 12:38:55 +0200 (CEST) Received: by mail-wr1-f53.google.com with SMTP id a11so17742769wrt.13 for ; Tue, 15 Jun 2021 03:38:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=BPAcW15Fw2dfCCK+Gs00x1szXvSV2HK1tA5wXTDAA20=; b=B51Hs1FafZLxf8vvdmEs1DwrHZ+VlRqFyIr+qhSqre7w2J/LZ+A1r8KlxEhuf4tMjN bfLUUPWeG+WIwjYEkA0Mi/sh7tnhQip6/c6ld3AX436XYyRwu+cAceQQLCrHNSUd3kxV hi90x0WD7GgJV1N0MPiqA7cf284xwO3BoPmlXCh6FtENmxrsE6Y4Le3ZTIenVSOG8MIF JK9mCao+YMlDKfp9L8fbWdnayf45liLDM7ObviL+tRc3YC62prB1KZdyTb2roBY4ZQgl lLyEzjGzPDptqPjxQTtC96Xa79r87psA4+udfcAOc6G1Pd/yw3vbEzPjz8bkbyXHBURu gEEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=BPAcW15Fw2dfCCK+Gs00x1szXvSV2HK1tA5wXTDAA20=; b=Rp3hcH6CuMmbJmK+A1hR7cw9anyVQ5A/GQXEYqXD7ptN6jezdEWOLz8kpWh12xye1V FuNsq3xYCiCQ9nSF3ejH5J+IAFjWAcpcLtx+5MdJM03eIkKGgblKv3nuG7gCt8IVTzyf tnADIaf8sjW+OvgDBbMSeyPcD9etd19W+D4YpRAOMoqVQ93oAjWbs2l5PeXbHdllegqb 5/97RmbeFwdnMYSIR/TrUvzWnlUlkPvr1TJ1iDgAPydXt+Ehlr18fMhP9OJfhocryIy8 q+ktT8XTFEjI+XNqROAorq3Z2Ulnfjuh/VDH0fisJcJTM0YPQP6zTzry+JaKTjHfN4Kj IINQ== X-Gm-Message-State: AOAM5302J5njmA03SgGw/oBUapfFSPqGF/2dw2rUbhwSY59p5h9zEX1y FRP05giXJYeiLqNMJf6V/CM= X-Google-Smtp-Source: ABdhPJwYERZCCcHW6pFapsbJMyhUy/uMHGNVieZA3UoON0XVaj0uB97fdKNzcGRoHj2XYU3aWrkdmw== X-Received: by 2002:a5d:47a5:: with SMTP id 5mr23721430wrb.259.1623753534921; Tue, 15 Jun 2021 03:38:54 -0700 (PDT) Received: from tucornea-dev-machine.localdomain ([193.226.172.44]) by smtp.gmail.com with ESMTPSA id v16sm19239770wrr.6.2021.06.15.03.38.54 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 15 Jun 2021 03:38:54 -0700 (PDT) From: Tudor Cornea X-Google-Original-From: Tudor Cornea To: qiming.yang@intel.com, qi.z.zhang@intel.com Cc: dev@dpdk.org, Tudor Cornea Date: Tue, 15 Jun 2021 13:38:34 +0300 Message-Id: <1623753514-36187-1-git-send-email-tudor.cornea@keysight.com> X-Mailer: git-send-email 2.7.4 X-Mailman-Approved-At: Wed, 16 Jun 2021 08:08:14 +0200 Subject: [dpdk-dev] [PATCH] net/ice: fix integer overflow when computing max_pkt_len X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" The len variable, used in the computation of max_pkt_len could overflow, if used to store the result of the following computation: ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len Since, we could define the mbuf size to have a large value (i.e 13312), and ICE_SUPPORT_CHAIN_NUM is defined as 5, the computation mentioned above could potentially result in a value which might be bigger than MAX_USHORT. The result will be that Jumbo Frames will not work properly Signed-off-by: Tudor Cornea --- drivers/net/ice/ice_dcf_ethdev.c | 7 ++++--- drivers/net/ice/ice_rxtx.c | 6 +++--- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/ice/ice_dcf_ethdev.c b/drivers/net/ice/ice_dcf_ethdev.c index b937cbb..f73dc80 100644 --- a/drivers/net/ice/ice_dcf_ethdev.c +++ b/drivers/net/ice/ice_dcf_ethdev.c @@ -54,13 +54,14 @@ ice_dcf_init_rxq(struct rte_eth_dev *dev, struct ice_rx_queue *rxq) struct ice_dcf_adapter *dcf_ad = dev->data->dev_private; struct rte_eth_dev_data *dev_data = dev->data; struct iavf_hw *hw = &dcf_ad->real_hw.avf; - uint16_t buf_size, max_pkt_len, len; + uint16_t buf_size, max_pkt_len; buf_size = rte_pktmbuf_data_room_size(rxq->mp) - RTE_PKTMBUF_HEADROOM; rxq->rx_hdr_len = 0; rxq->rx_buf_len = RTE_ALIGN(buf_size, (1 << ICE_RLAN_CTX_DBUF_S)); - len = ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len; - max_pkt_len = RTE_MIN(len, dev->data->dev_conf.rxmode.max_rx_pkt_len); + max_pkt_len = RTE_MIN((uint32_t) + ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len, + dev->data->dev_conf.rxmode.max_rx_pkt_len); /* Check if the jumbo frame and maximum packet length are set * correctly. diff --git a/drivers/net/ice/ice_rxtx.c b/drivers/net/ice/ice_rxtx.c index fc9bb5a..20352b0 100644 --- a/drivers/net/ice/ice_rxtx.c +++ b/drivers/net/ice/ice_rxtx.c @@ -258,7 +258,7 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq) struct rte_eth_dev_data *dev_data = rxq->vsi->adapter->pf.dev_data; struct ice_rlan_ctx rx_ctx; enum ice_status err; - uint16_t buf_size, len; + uint16_t buf_size; struct rte_eth_rxmode *rxmode = &dev_data->dev_conf.rxmode; uint32_t rxdid = ICE_RXDID_COMMS_OVS; uint32_t regval; @@ -268,8 +268,8 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq) RTE_PKTMBUF_HEADROOM); rxq->rx_hdr_len = 0; rxq->rx_buf_len = RTE_ALIGN(buf_size, (1 << ICE_RLAN_CTX_DBUF_S)); - len = ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len; - rxq->max_pkt_len = RTE_MIN(len, + rxq->max_pkt_len = RTE_MIN((uint32_t) + ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len, dev_data->dev_conf.rxmode.max_rx_pkt_len); if (rxmode->offloads & DEV_RX_OFFLOAD_JUMBO_FRAME) { -- 2.7.4