Skip to content

Commit

Permalink
net/mlx5: fix overflow in mempool argument
Browse files Browse the repository at this point in the history
[ upstream commit 2fec07e ]

The mlx5_mprq_alloc_mp function makes shifting to the numeric constant
1, for sending it as a parameter to rte_mempool_create function.

The rte_mempool_create function expects to get void pointer (uintptr_t,
might be 64-bit) and instead gets a 32-bit variable, because the
numeric constant size is a 32-bit.
In case the shift is greater than 32 the variable might lose its value
even though the function might get 64-bit argument.

Change the size of the numeric constant 1 to uintptr_t.

Fixes: 3a22f38 ("net/mlx5: replace external mbuf shared memory")

Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
  • Loading branch information
michaelbaum1 authored and cpaelzer committed Aug 10, 2021
1 parent 76f8afe commit 373eada
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/net/mlx5/mlx5_rxq.c
Expand Up @@ -1683,7 +1683,7 @@ mlx5_mprq_alloc_mp(struct rte_eth_dev *dev)
snprintf(name, sizeof(name), "port-%u-mprq", dev->data->port_id);
mp = rte_mempool_create(name, obj_num, obj_size, MLX5_MPRQ_MP_CACHE_SZ,
0, NULL, NULL, mlx5_mprq_buf_init,
(void *)(uintptr_t)(1 << strd_num_n),
(void *)((uintptr_t)1 << strd_num_n),
dev->device->numa_node, 0);
if (mp == NULL) {
DRV_LOG(ERR,
Expand Down

0 comments on commit 373eada

Please sign in to comment.