From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id EB1E5A3168 for ; Wed, 16 Oct 2019 05:23:55 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id BE3381E917; Wed, 16 Oct 2019 05:23:55 +0200 (CEST) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by dpdk.org (Postfix) with ESMTP id EBCAA1E551; Wed, 16 Oct 2019 05:23:50 +0200 (CEST) X-Amp-Result: UNKNOWN X-Amp-Original-Verdict: FILE UNKNOWN X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Oct 2019 20:23:50 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.67,302,1566889200"; d="scan'208";a="208316488" Received: from yexl-server.sh.intel.com (HELO localhost) ([10.67.117.17]) by fmsmga001.fm.intel.com with ESMTP; 15 Oct 2019 20:23:48 -0700 Date: Wed, 16 Oct 2019 11:21:06 +0800 From: Ye Xiaolong To: Xiao Zhang Cc: dev@dpdk.org, beilei.xing@intel.com, qi.z.zhang@intel.com, ktraynor@redhat.com, stable@dpdk.org Message-ID: <20191016032106.GJ3725@intel.com> References: <1571041986-37562-1-git-send-email-xiao.zhang@intel.com> <1571117359-34227-1-git-send-email-xiao.zhang@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1571117359-34227-1-git-send-email-xiao.zhang@intel.com> User-Agent: Mutt/1.9.4 (2018-02-28) Subject: Re: [dpdk-stable] [dpdk-dev] [v2] net/i40e: fix integer overflow X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" On 10/15, Xiao Zhang wrote: >When config i40e rx queue, the temporary variable to store max packet >length is not big enough which leads to integer overflow issue. This >patch is to fix the issue by removing the variable and using the >expression directly since the variable only used once. > >Fixes: 4861cde46116 ("i40e: new poll mode driver") >Cc: stable@dpdk.org > >Signed-off-by: Xiao Zhang >--- >v2 >Correct the fixline and remove temporary variable. >--- > drivers/net/i40e/i40e_rxtx.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > >diff --git a/drivers/net/i40e/i40e_rxtx.c b/drivers/net/i40e/i40e_rxtx.c >index bfe161f..ff6eb4a 100644 >--- a/drivers/net/i40e/i40e_rxtx.c >+++ b/drivers/net/i40e/i40e_rxtx.c >@@ -2596,7 +2596,7 @@ i40e_rx_queue_config(struct i40e_rx_queue *rxq) > struct i40e_pf *pf = I40E_VSI_TO_PF(rxq->vsi); > struct i40e_hw *hw = I40E_VSI_TO_HW(rxq->vsi); > struct rte_eth_dev_data *data = pf->dev_data; >- uint16_t buf_size, len; >+ uint16_t buf_size; > > buf_size = (uint16_t)(rte_pktmbuf_data_room_size(rxq->mp) - > RTE_PKTMBUF_HEADROOM); >@@ -2619,8 +2619,9 @@ i40e_rx_queue_config(struct i40e_rx_queue *rxq) > break; > } > >- len = hw->func_caps.rx_buf_chain_len * rxq->rx_buf_len; >- rxq->max_pkt_len = RTE_MIN(len, data->dev_conf.rxmode.max_rx_pkt_len); >+ rxq->max_pkt_len = >+ RTE_MIN((uint32_t)(hw->func_caps.rx_buf_chain_len * >+ rxq->rx_buf_len), data->dev_conf.rxmode.max_rx_pkt_len); > if (data->dev_conf.rxmode.offloads & DEV_RX_OFFLOAD_JUMBO_FRAME) { > if (rxq->max_pkt_len <= RTE_ETHER_MAX_LEN || > rxq->max_pkt_len > I40E_FRAME_SIZE_MAX) { >-- >2.7.4 > Acked-by: Xiaolong Ye Applied to dpdk-next-net-intel.