From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id D876CA0C47; Tue, 15 Jun 2021 11:59:12 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 613494067A; Tue, 15 Jun 2021 11:59:12 +0200 (CEST) Received: from mail-ed1-f49.google.com (mail-ed1-f49.google.com [209.85.208.49]) by mails.dpdk.org (Postfix) with ESMTP id 680DF40140 for ; Tue, 15 Jun 2021 11:59:11 +0200 (CEST) Received: by mail-ed1-f49.google.com with SMTP id ba2so48496306edb.2 for ; Tue, 15 Jun 2021 02:59:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=MfvJSczjbDRNEiudQaiXoaIJ43bdHu3eRFrvmoWlNwQ=; b=JCaAoCMlUdSO5ksBEguhLOI6ke9ZBgCPhmzoKPcBBtnY33sLv01kwe6TWZHtULsjf2 pbVdYxOIgaRKxa3K9KJ01OE3kIHHzaVscpZF3+u/uZq4NU8hGU5o1aWO1z+Rw0agCUwT PRThaKj+OZoWDQ65sPfc5wiPHvP2r07QwpAUy/1mkwcheap0FoGWPTESB191udgnBk6d Kw2nYGlPmE3MGbwlWeJY6HOW9L829JAAo5oAZwtWrhx2Lj8McPyYx+32O9GDXsckgg1o W8dq9eO4AYjZq9iAqLQJwyQfRy0Su90dhUWX7uJR4Ve1yYcDGX+PD/gdnO0qCKIbwYEc L5vA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=MfvJSczjbDRNEiudQaiXoaIJ43bdHu3eRFrvmoWlNwQ=; b=S1WrjOJWUyjtGUxQikQzWjhRPWI5UhPlHJGvG28Qp/1SysJHLVVpB/ViXnefgSBAf6 8Q0D0Iirr9eSosKqnNhXkSKlmXEe+v5W12UApzEtYVTeE9mEPe3hNJrkExibhYbJ2Pzz OktDEV5/xXPVFVH82ANwQhDjb10X9srKaozi40MushsI6K5XPCpfoHnvDTJ0jwifSIXW GRzNbHK9jx+ccnoNbQ1Rg3K37M/CzxucSFRbpBqpy7km2qBQt+9ack7V8ECJ1oJfQXwh +epm+SL0nSKNmGfGcp2+KhldurXwJ9zT4CWcpgzk3eW/LY1T1gNgWnOLb14yN8iaSef1 Yjxw== X-Gm-Message-State: AOAM5302oj+eTT86KUR5oiiZpIZvx3k+KKDutjGkDjNKmGMx0+FA0sMB sGjr647iRLv4asM+CEkDpegdC1e7+8g1zkMLEyI/QkSHZ0l8jg== X-Google-Smtp-Source: ABdhPJz9TQxfKrvoLsExSKrDT09BQ7Gotu5YBsNKj98ugnTzkNEmPp+ToAZLfFz7oWjSE9zBiRO4FI4etPZf9EUJSbM= X-Received: by 2002:a05:6402:40c3:: with SMTP id z3mr21981924edb.187.1623751150851; Tue, 15 Jun 2021 02:59:10 -0700 (PDT) MIME-Version: 1.0 From: Tudor Cornea Date: Tue, 15 Jun 2021 12:58:59 +0300 Message-ID: To: dev@dpdk.org, qiming.yang@intel.com, qi.z.zhang@intel.com Content-Type: text/plain; charset="UTF-8" X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: [dpdk-dev] [PATCH] net/ice: fix integer overflow when computing max_pkt_len X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Greetings, Please review the following patch for the dpdk-next-net-intel branch. The len variable, used in the computation of max_pkt_len could overflow, if used to store the result of the following computation: ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len Since, we could define the mbuf size to have a large value (i.e 13312), and ICE_SUPPORT_CHAIN_NUM is defined as 5, the computation mentioned above could potentially result in a value which might be bigger than MAX_USHORT. The result will be that Jumbo Frames will not work properly Signed-off-by: Tudor Cornea --- drivers/net/ice/ice_dcf_ethdev.c | 7 ++++--- drivers/net/ice/ice_rxtx.c | 6 +++--- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/ice/ice_dcf_ethdev.c b/drivers/net/ice/ice_dcf_ethdev.c index b937cbb..f73dc80 100644 --- a/drivers/net/ice/ice_dcf_ethdev.c +++ b/drivers/net/ice/ice_dcf_ethdev.c @@ -54,13 +54,14 @@ ice_dcf_init_rxq(struct rte_eth_dev *dev, struct ice_rx_queue *rxq) struct ice_dcf_adapter *dcf_ad = dev->data->dev_private; struct rte_eth_dev_data *dev_data = dev->data; struct iavf_hw *hw = &dcf_ad->real_hw.avf; - uint16_t buf_size, max_pkt_len, len; + uint16_t buf_size, max_pkt_len; buf_size = rte_pktmbuf_data_room_size(rxq->mp) - RTE_PKTMBUF_HEADROOM; rxq->rx_hdr_len = 0; rxq->rx_buf_len = RTE_ALIGN(buf_size, (1 << ICE_RLAN_CTX_DBUF_S)); - len = ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len; - max_pkt_len = RTE_MIN(len, dev->data->dev_conf.rxmode.max_rx_pkt_len); + max_pkt_len = RTE_MIN((uint32_t) + ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len, + dev->data->dev_conf.rxmode.max_rx_pkt_len); /* Check if the jumbo frame and maximum packet length are set * correctly. diff --git a/drivers/net/ice/ice_rxtx.c b/drivers/net/ice/ice_rxtx.c index fc9bb5a..20352b0 100644 --- a/drivers/net/ice/ice_rxtx.c +++ b/drivers/net/ice/ice_rxtx.c @@ -258,7 +258,7 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq) struct rte_eth_dev_data *dev_data = rxq->vsi->adapter->pf.dev_data; struct ice_rlan_ctx rx_ctx; enum ice_status err; - uint16_t buf_size, len; + uint16_t buf_size; struct rte_eth_rxmode *rxmode = &dev_data->dev_conf.rxmode; uint32_t rxdid = ICE_RXDID_COMMS_OVS; uint32_t regval; @@ -268,8 +268,8 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq) RTE_PKTMBUF_HEADROOM); rxq->rx_hdr_len = 0; rxq->rx_buf_len = RTE_ALIGN(buf_size, (1 << ICE_RLAN_CTX_DBUF_S)); - len = ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len; - rxq->max_pkt_len = RTE_MIN(len, + rxq->max_pkt_len = RTE_MIN((uint32_t) + ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len, dev_data->dev_conf.rxmode.max_rx_pkt_len); if (rxmode->offloads & DEV_RX_OFFLOAD_JUMBO_FRAME) { -- 2.7.4