From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 31CD4A2EFC for ; Tue, 15 Oct 2019 07:31:36 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 09F151C437; Tue, 15 Oct 2019 07:31:36 +0200 (CEST) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by dpdk.org (Postfix) with ESMTP id BCE711C2A4; Tue, 15 Oct 2019 07:31:31 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 14 Oct 2019 22:31:30 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.67,298,1566889200"; d="scan'208";a="207438059" Received: from npg-dpdk-zhangxiao.sh.intel.com ([10.67.110.190]) by orsmga002.jf.intel.com with ESMTP; 14 Oct 2019 22:31:28 -0700 From: Xiao Zhang To: dev@dpdk.org Cc: beilei.xing@intel.com, qi.z.zhang@intel.com, ktraynor@redhat.com, Xiao Zhang , stable@dpdk.org Date: Tue, 15 Oct 2019 13:29:19 +0800 Message-Id: <1571117359-34227-1-git-send-email-xiao.zhang@intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1571041986-37562-1-git-send-email-xiao.zhang@intel.com> References: <1571041986-37562-1-git-send-email-xiao.zhang@intel.com> Subject: [dpdk-stable] [v2] net/i40e: fix integer overflow X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" When config i40e rx queue, the temporary variable to store max packet length is not big enough which leads to integer overflow issue. This patch is to fix the issue by removing the variable and using the expression directly since the variable only used once. Fixes: 4861cde46116 ("i40e: new poll mode driver") Cc: stable@dpdk.org Signed-off-by: Xiao Zhang --- v2 Correct the fixline and remove temporary variable. --- drivers/net/i40e/i40e_rxtx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/i40e/i40e_rxtx.c b/drivers/net/i40e/i40e_rxtx.c index bfe161f..ff6eb4a 100644 --- a/drivers/net/i40e/i40e_rxtx.c +++ b/drivers/net/i40e/i40e_rxtx.c @@ -2596,7 +2596,7 @@ i40e_rx_queue_config(struct i40e_rx_queue *rxq) struct i40e_pf *pf = I40E_VSI_TO_PF(rxq->vsi); struct i40e_hw *hw = I40E_VSI_TO_HW(rxq->vsi); struct rte_eth_dev_data *data = pf->dev_data; - uint16_t buf_size, len; + uint16_t buf_size; buf_size = (uint16_t)(rte_pktmbuf_data_room_size(rxq->mp) - RTE_PKTMBUF_HEADROOM); @@ -2619,8 +2619,9 @@ i40e_rx_queue_config(struct i40e_rx_queue *rxq) break; } - len = hw->func_caps.rx_buf_chain_len * rxq->rx_buf_len; - rxq->max_pkt_len = RTE_MIN(len, data->dev_conf.rxmode.max_rx_pkt_len); + rxq->max_pkt_len = + RTE_MIN((uint32_t)(hw->func_caps.rx_buf_chain_len * + rxq->rx_buf_len), data->dev_conf.rxmode.max_rx_pkt_len); if (data->dev_conf.rxmode.offloads & DEV_RX_OFFLOAD_JUMBO_FRAME) { if (rxq->max_pkt_len <= RTE_ETHER_MAX_LEN || rxq->max_pkt_len > I40E_FRAME_SIZE_MAX) { -- 2.7.4