[PATCH v1 1/1] net/ixgbe: fix PF link state request mailbox size

[PATCH v1 1/1] net/ixgbe: fix PF link state request mailbox size

[Anatoly Burakov]

From: Andrzej Wilczynski <andrzejx.wilczynski@intel.com>

Currently, when requesting PF link state over VF mailbox, the buffer sized
3 dwords is allocated. However, the `ixgbevf_write_msg_read_ack` function
is actually called with buffer size of 6 dwords. This leaves an admittedly
remote possibility of buffer overrun. Fix by adjusting requested size to 3.

Fixes: adbd71030575 ("net/ixgbe/base: fix link status for E610")

Signed-off-by: Andrzej Wilczynski <andrzejx.wilczynski@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
 drivers/net/intel/ixgbe/base/ixgbe_vf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/intel/ixgbe/base/ixgbe_vf.c b/drivers/net/intel/ixgbe/base/ixgbe_vf.c
index 46a62bb851..eb16fb1942 100644
--- a/drivers/net/intel/ixgbe/base/ixgbe_vf.c
+++ b/drivers/net/intel/ixgbe/base/ixgbe_vf.c
@@ -482,7 +482,7 @@ int ixgbevf_get_pf_link_state(struct ixgbe_hw *hw, ixgbe_link_speed *speed,
 
 	msgbuf[0] = IXGBE_VF_GET_PF_LINK_STATE;
 
-	err = ixgbevf_write_msg_read_ack(hw, msgbuf, msgbuf, 6);
+	err = ixgbevf_write_msg_read_ack(hw, msgbuf, msgbuf, 3);
 	if (err || (msgbuf[0] & IXGBE_VT_MSGTYPE_FAILURE)) {
 		err = IXGBE_ERR_MBX;
 		*speed = IXGBE_LINK_SPEED_UNKNOWN;
-- 
2.47.3

Re: [PATCH v1 1/1] net/ixgbe: fix PF link state request mailbox size

[Bruce Richardson]

On Mon, Nov 10, 2025 at 01:55:39PM +0000, Anatoly Burakov wrote:
> From: Andrzej Wilczynski <andrzejx.wilczynski@intel.com>
> 
> Currently, when requesting PF link state over VF mailbox, the buffer sized
> 3 dwords is allocated. However, the `ixgbevf_write_msg_read_ack` function
> is actually called with buffer size of 6 dwords. This leaves an admittedly
> remote possibility of buffer overrun. Fix by adjusting requested size to 3.
> 
> Fixes: adbd71030575 ("net/ixgbe/base: fix link status for E610")
> 
> Signed-off-by: Andrzej Wilczynski <andrzejx.wilczynski@intel.com>
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH v1 1/1] net/ixgbe: fix PF link state request mailbox size

[Bruce Richardson]

On Wed, Nov 12, 2025 at 03:51:55PM +0000, Bruce Richardson wrote:
> On Mon, Nov 10, 2025 at 01:55:39PM +0000, Anatoly Burakov wrote:
> > From: Andrzej Wilczynski <andrzejx.wilczynski@intel.com>
> > 
> > Currently, when requesting PF link state over VF mailbox, the buffer sized
> > 3 dwords is allocated. However, the `ixgbevf_write_msg_read_ack` function
> > is actually called with buffer size of 6 dwords. This leaves an admittedly
> > remote possibility of buffer overrun. Fix by adjusting requested size to 3.
> > 
> > Fixes: adbd71030575 ("net/ixgbe/base: fix link status for E610")
> > 
> > Signed-off-by: Andrzej Wilczynski <andrzejx.wilczynski@intel.com>
> > Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
> > ---
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> 
Bugzilla ID: 1801

Cc: stable@dpdk.org

Applied to dpdk-next-net-intel, thanks.

/Bruce