From 345f2731ed564636d2b9380c8be01ab4aafc93d0 Mon Sep 17 00:00:00 2001 From: Tudor Cornea Date: Tue, 15 Jun 2021 13:38:34 +0300 Subject: [PATCH] net/ice: fix overflow in maximum packet length config [ upstream commit 58bb86cf13b8535fa8786f97cc9a4dfaa780a51e ] The len variable, used in the computation of max_pkt_len could overflow, if used to store the result of the following computation: ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len Since, we could define the mbuf size to have a large value (i.e 13312), and ICE_SUPPORT_CHAIN_NUM is defined as 5, the computation mentioned above could potentially result in a value which might be bigger than MAX_USHORT. The result will be that Jumbo Frames will not work properly Fixes: 1b009275e2c8 ("net/ice: add Rx queue init in DCF") Signed-off-by: Tudor Cornea Acked-by: Qi Zhang --- drivers/net/ice/ice_dcf_ethdev.c | 7 ++++--- drivers/net/ice/ice_rxtx.c | 6 +++--- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/ice/ice_dcf_ethdev.c b/drivers/net/ice/ice_dcf_ethdev.c index e5c877805f..71f8a4b4cc 100644 --- a/drivers/net/ice/ice_dcf_ethdev.c +++ b/drivers/net/ice/ice_dcf_ethdev.c @@ -48,13 +48,14 @@ ice_dcf_init_rxq(struct rte_eth_dev *dev, struct ice_rx_queue *rxq) struct ice_dcf_adapter *dcf_ad = dev->data->dev_private; struct rte_eth_dev_data *dev_data = dev->data; struct iavf_hw *hw = &dcf_ad->real_hw.avf; - uint16_t buf_size, max_pkt_len, len; + uint16_t buf_size, max_pkt_len; buf_size = rte_pktmbuf_data_room_size(rxq->mp) - RTE_PKTMBUF_HEADROOM; rxq->rx_hdr_len = 0; rxq->rx_buf_len = RTE_ALIGN(buf_size, (1 << ICE_RLAN_CTX_DBUF_S)); - len = ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len; - max_pkt_len = RTE_MIN(len, dev->data->dev_conf.rxmode.max_rx_pkt_len); + max_pkt_len = RTE_MIN((uint32_t) + ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len, + dev->data->dev_conf.rxmode.max_rx_pkt_len); /* Check if the jumbo frame and maximum packet length are set * correctly. diff --git a/drivers/net/ice/ice_rxtx.c b/drivers/net/ice/ice_rxtx.c index f9a475cbb8..8ac9411083 100644 --- a/drivers/net/ice/ice_rxtx.c +++ b/drivers/net/ice/ice_rxtx.c @@ -231,7 +231,7 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq) struct rte_eth_dev_data *dev_data = rxq->vsi->adapter->pf.dev_data; struct ice_rlan_ctx rx_ctx; enum ice_status err; - uint16_t buf_size, len; + uint16_t buf_size; struct rte_eth_rxmode *rxmode = &dev_data->dev_conf.rxmode; uint32_t rxdid = ICE_RXDID_COMMS_OVS; uint32_t regval; @@ -241,8 +241,8 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq) RTE_PKTMBUF_HEADROOM); rxq->rx_hdr_len = 0; rxq->rx_buf_len = RTE_ALIGN(buf_size, (1 << ICE_RLAN_CTX_DBUF_S)); - len = ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len; - rxq->max_pkt_len = RTE_MIN(len, + rxq->max_pkt_len = RTE_MIN((uint32_t) + ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len, dev_data->dev_conf.rxmode.max_rx_pkt_len); if (rxmode->offloads & DEV_RX_OFFLOAD_JUMBO_FRAME) {