The mlx5_check_vec_rx_support function in the mlx5_rxtx_vec.c file passes the RX queues array in the loop. Similarly, the mlx5_mprq_enabled function in the mlx5_rxq.c file passes the RX queues array in the loop. In both cases, the iterator of the loop is called i and the variable representing the array size is called rxqs_n. The i variable is of UINT16_T type while the rxqs_n variable is of unsigned int type. The size of the rxqs_n variable is much larger than the number of iterations allowed by the i type, theoretically there may be a situation where the value of the rxqs_n will be greater than can be represented by 16 bits and the loop will never end. Change the type of i to UINT32_T. Fixes: 7d6bf6b866b8 ("net/mlx5: add Multi-Packet Rx support") Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86") Cc: stable@dpdk.org Signed-off-by: Michael Baum <michaelba@mellanox.com> Acked-by: Matan Azrad <matan@mellanox.com> --- drivers/net/mlx5/mlx5_rxq.c | 2 +- drivers/net/mlx5/mlx5_rxtx_vec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index bd0037b..b436f06 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -108,7 +108,7 @@ mlx5_mprq_enabled(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; uint16_t n = 0; uint16_t n_ibv = 0; diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c b/drivers/net/mlx5/mlx5_rxtx_vec.c index b38bd20..7fae201 100644 --- a/drivers/net/mlx5/mlx5_rxtx_vec.c +++ b/drivers/net/mlx5/mlx5_rxtx_vec.c @@ -156,7 +156,7 @@ mlx5_check_vec_rx_support(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; if (!priv->config.rx_vec_en) return -ENOTSUP; -- 1.8.3.1
The mlx5_check_vec_rx_support function in the mlx5_rxtx_vec.c file passes the RX queues array in the loop. Similarly, the mlx5_mprq_enabled function in the mlx5_rxq.c file passes the RX queues array in the loop. In both cases, the iterator of the loop is called i and the variable representing the array size is called rxqs_n. The i variable is of UINT16_T type while the rxqs_n variable is of unsigned int type. The size of the rxqs_n variable is much larger than the number of iterations allowed by the i type, theoretically there may be a situation where the value of the rxqs_n will be greater than can be represented by 16 bits and the loop will never end. Change the type of i to UINT32_T. Fixes: 7d6bf6b866b8 ("net/mlx5: add Multi-Packet Rx support") Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86") Cc: stable@dpdk.org Signed-off-by: Michael Baum <michaelba@mellanox.com> Acked-by: Matan Azrad <matan@mellanox.com> --- drivers/net/mlx5/mlx5_rxq.c | 2 +- drivers/net/mlx5/mlx5_rxtx_vec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index bd0037b..b436f06 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -108,7 +108,7 @@ mlx5_mprq_enabled(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; uint16_t n = 0; uint16_t n_ibv = 0; diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c b/drivers/net/mlx5/mlx5_rxtx_vec.c index b38bd20..7fae201 100644 --- a/drivers/net/mlx5/mlx5_rxtx_vec.c +++ b/drivers/net/mlx5/mlx5_rxtx_vec.c @@ -156,7 +156,7 @@ mlx5_check_vec_rx_support(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; if (!priv->config.rx_vec_en) return -ENOTSUP; -- 1.8.3.1
The mlx5_check_vec_rx_support function in the mlx5_rxtx_vec.c file passes the RX queues array in the loop. Similarly, the mlx5_mprq_enabled function in the mlx5_rxq.c file passes the RX queues array in the loop. In both cases, the iterator of the loop is called i and the variable representing the array size is called rxqs_n. The i variable is of UINT16_T type while the rxqs_n variable is of unsigned int type. The size of the rxqs_n variable is much larger than the number of iterations allowed by the i type, theoretically there may be a situation where the value of the rxqs_n will be greater than can be represented by 16 bits and the loop will never end. Change the type of i to UINT32_T. Fixes: 7d6bf6b866b8 ("net/mlx5: add Multi-Packet Rx support") Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86") Cc: stable@dpdk.org Signed-off-by: Michael Baum <michaelba@mellanox.com> Acked-by: Matan Azrad <matan@mellanox.com> --- drivers/net/mlx5/mlx5_rxq.c | 2 +- drivers/net/mlx5/mlx5_rxtx_vec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index bd0037b..b436f06 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -108,7 +108,7 @@ mlx5_mprq_enabled(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; uint16_t n = 0; uint16_t n_ibv = 0; diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c b/drivers/net/mlx5/mlx5_rxtx_vec.c index b38bd20..7fae201 100644 --- a/drivers/net/mlx5/mlx5_rxtx_vec.c +++ b/drivers/net/mlx5/mlx5_rxtx_vec.c @@ -156,7 +156,7 @@ mlx5_check_vec_rx_support(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; if (!priv->config.rx_vec_en) return -ENOTSUP; -- 1.8.3.1
The mlx5_check_vec_rx_support function in the mlx5_rxtx_vec.c file passes the RX queues array in the loop. Similarly, the mlx5_mprq_enabled function in the mlx5_rxq.c file passes the RX queues array in the loop. In both cases, the iterator of the loop is called i and the variable representing the array size is called rxqs_n. The i variable is of UINT16_T type while the rxqs_n variable is of unsigned int type. The size of the rxqs_n variable is much larger than the number of iterations allowed by the i type, theoretically there may be a situation where the value of the rxqs_n will be greater than can be represented by 16 bits and the loop will never end. Change the type of i to UINT32_T. Fixes: 7d6bf6b866b8 ("net/mlx5: add Multi-Packet Rx support") Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86") Cc: stable@dpdk.org Signed-off-by: Michael Baum <michaelba@mellanox.com> Acked-by: Matan Azrad <matan@mellanox.com> --- drivers/net/mlx5/mlx5_rxq.c | 2 +- drivers/net/mlx5/mlx5_rxtx_vec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index bd0037b..b436f06 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -108,7 +108,7 @@ mlx5_mprq_enabled(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; uint16_t n = 0; uint16_t n_ibv = 0; diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c b/drivers/net/mlx5/mlx5_rxtx_vec.c index b38bd20..7fae201 100644 --- a/drivers/net/mlx5/mlx5_rxtx_vec.c +++ b/drivers/net/mlx5/mlx5_rxtx_vec.c @@ -156,7 +156,7 @@ mlx5_check_vec_rx_support(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; if (!priv->config.rx_vec_en) return -ENOTSUP; -- 1.8.3.1
The mlx5_check_vec_rx_support function in the mlx5_rxtx_vec.c file passes the RX queues array in the loop. Similarly, the mlx5_mprq_enabled function in the mlx5_rxq.c file passes the RX queues array in the loop. In both cases, the iterator of the loop is called i and the variable representing the array size is called rxqs_n. The i variable is of UINT16_T type while the rxqs_n variable is of unsigned int type. The size of the rxqs_n variable is much larger than the number of iterations allowed by the i type, theoretically there may be a situation where the value of the rxqs_n will be greater than can be represented by 16 bits and the loop will never end. Change the type of i to UINT32_T. Fixes: 7d6bf6b866b8 ("net/mlx5: add Multi-Packet Rx support") Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86") Cc: stable@dpdk.org Signed-off-by: Michael Baum <michaelba@mellanox.com> Acked-by: Matan Azrad <matan@mellanox.com> --- drivers/net/mlx5/mlx5_rxq.c | 2 +- drivers/net/mlx5/mlx5_rxtx_vec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index bd0037b..b436f06 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -108,7 +108,7 @@ mlx5_mprq_enabled(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; uint16_t n = 0; uint16_t n_ibv = 0; diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c b/drivers/net/mlx5/mlx5_rxtx_vec.c index b38bd20..7fae201 100644 --- a/drivers/net/mlx5/mlx5_rxtx_vec.c +++ b/drivers/net/mlx5/mlx5_rxtx_vec.c @@ -156,7 +156,7 @@ mlx5_check_vec_rx_support(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; if (!priv->config.rx_vec_en) return -ENOTSUP; -- 1.8.3.1
The mlx5_check_vec_rx_support function in the mlx5_rxtx_vec.c file passes the RX queues array in the loop. Similarly, the mlx5_mprq_enabled function in the mlx5_rxq.c file passes the RX queues array in the loop. In both cases, the iterator of the loop is called i and the variable representing the array size is called rxqs_n. The i variable is of UINT16_T type while the rxqs_n variable is of unsigned int type. The size of the rxqs_n variable is much larger than the number of iterations allowed by the i type, theoretically there may be a situation where the value of the rxqs_n will be greater than can be represented by 16 bits and the loop will never end. Change the type of i to UINT32_T. Fixes: 7d6bf6b866b8 ("net/mlx5: add Multi-Packet Rx support") Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86") Cc: stable@dpdk.org Signed-off-by: Michael Baum <michaelba@mellanox.com> Acked-by: Matan Azrad <matan@mellanox.com> --- drivers/net/mlx5/mlx5_rxq.c | 2 +- drivers/net/mlx5/mlx5_rxtx_vec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index bd0037b..b436f06 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -108,7 +108,7 @@ mlx5_mprq_enabled(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; uint16_t n = 0; uint16_t n_ibv = 0; diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c b/drivers/net/mlx5/mlx5_rxtx_vec.c index b38bd20..7fae201 100644 --- a/drivers/net/mlx5/mlx5_rxtx_vec.c +++ b/drivers/net/mlx5/mlx5_rxtx_vec.c @@ -156,7 +156,7 @@ mlx5_check_vec_rx_support(struct rte_eth_dev *dev) { struct mlx5_priv *priv = dev->data->dev_private; - uint16_t i; + uint32_t i; if (!priv->config.rx_vec_en) return -ENOTSUP; -- 1.8.3.1
Hi,
> -----Original Message-----
> From: dev <dev-bounces@dpdk.org> On Behalf Of Michael Baum
> Sent: Wednesday, June 24, 2020 5:07 PM
> To: dev@dpdk.org
> Cc: Matan Azrad <matan@mellanox.com>; Slava Ovsiienko
> <viacheslavo@mellanox.com>; stable@dpdk.org
> Subject: [dpdk-dev] [PATCH] net/mlx5: fix iterator type in Rx queue
> management
>
> The mlx5_check_vec_rx_support function in the mlx5_rxtx_vec.c file
> passes the RX queues array in the loop. Similarly, the mlx5_mprq_enabled
> function in the mlx5_rxq.c file passes the RX queues array in the loop.
>
> In both cases, the iterator of the loop is called i and the variable
> representing the array size is called rxqs_n.
> The i variable is of UINT16_T type while the rxqs_n variable is of
> unsigned int type. The size of the rxqs_n variable is much larger than
> the number of iterations allowed by the i type, theoretically there may
> be a situation where the value of the rxqs_n will be greater than can be
> represented by 16 bits and the loop will never end.
>
> Change the type of i to UINT32_T.
>
> Fixes: 7d6bf6b866b8 ("net/mlx5: add Multi-Packet Rx support")
> Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86")
> Cc: stable@dpdk.org
>
> Signed-off-by: Michael Baum <michaelba@mellanox.com>
> Acked-by: Matan Azrad <matan@mellanox.com>
> ---
> drivers/net/mlx5/mlx5_rxq.c | 2 +-
> drivers/net/mlx5/mlx5_rxtx_vec.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
> index bd0037b..b436f06 100644
> --- a/drivers/net/mlx5/mlx5_rxq.c
> +++ b/drivers/net/mlx5/mlx5_rxq.c
> @@ -108,7 +108,7 @@
> mlx5_mprq_enabled(struct rte_eth_dev *dev)
> {
> struct mlx5_priv *priv = dev->data->dev_private;
> - uint16_t i;
> + uint32_t i;
> uint16_t n = 0;
> uint16_t n_ibv = 0;
>
> diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c
> b/drivers/net/mlx5/mlx5_rxtx_vec.c
> index b38bd20..7fae201 100644
> --- a/drivers/net/mlx5/mlx5_rxtx_vec.c
> +++ b/drivers/net/mlx5/mlx5_rxtx_vec.c
> @@ -156,7 +156,7 @@
> mlx5_check_vec_rx_support(struct rte_eth_dev *dev)
> {
> struct mlx5_priv *priv = dev->data->dev_private;
> - uint16_t i;
> + uint32_t i;
>
> if (!priv->config.rx_vec_en)
> return -ENOTSUP;
> --
> 1.8.3.1
Patch applied to next-net-mlx,
Kindest regards,
Raslan Darawsheh