netdev - [PATCH] ionic: fix 16bit math issue when PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230911222212.103406-1-drc@linux.vnet.ibm.com>
Date: Mon, 11 Sep 2023 18:22:12 -0400
From: David Christensen <drc@...ux.vnet.ibm.com>
To: shannon.nelson@....com, brett.creeley@....com, drivers@...sando.io
Cc: netdev@...r.kernel.org, David Christensen <drc@...ux.vnet.ibm.com>
Subject: [PATCH] ionic: fix 16bit math issue when PAGE_SIZE >= 64KB

The function ionic_rx_fill() uses 16bit math when calculating the
the number of pages required for an RX descriptor given an interface
MTU setting. If the system PAGE_SIZE >= 64KB, the frag_len and
remain_len values will always be 0, causing unnecessary scatter-
gather elements to be assigned to the RX descriptor, up to the
maximum number of scatter-gather elements per descriptor.

A similar change in ionic_rx_frags() is implemented for symmetry,
but has not been observed as an issue since scatter-gather
elements are not necessary for such larger page sizes.

Fixes: 4b0a7539a372 ("ionic: implement Rx page reuse")
Signed-off-by: David Christensen <drc@...ux.vnet.ibm.com>
---
 drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
index 26798fc635db..56502bc80e01 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
@@ -182,8 +182,8 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q,
 	struct device *dev = q->dev;
 	struct sk_buff *skb;
 	unsigned int i;
-	u16 frag_len;
-	u16 len;
+	u32 frag_len;
+	u32 len;
 
 	stats = q_to_rx_stats(q);
 
@@ -207,7 +207,7 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q,
 			return NULL;
 		}
 
-		frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);
+		frag_len = min_t(u32, len, IONIC_PAGE_SIZE - buf_info->page_offset);
 		len -= frag_len;
 
 		dma_sync_single_for_cpu(dev,
@@ -452,7 +452,7 @@ void ionic_rx_fill(struct ionic_queue *q)
 
 		/* fill main descriptor - buf[0] */
 		desc->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);
-		frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);
+		frag_len = min_t(u32, len, IONIC_PAGE_SIZE - buf_info->page_offset);
 		desc->len = cpu_to_le16(frag_len);
 		remain_len -= frag_len;
 		buf_info++;
@@ -471,7 +471,7 @@ void ionic_rx_fill(struct ionic_queue *q)
 			}
 
 			sg_elem->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);
-			frag_len = min_t(u16, remain_len, IONIC_PAGE_SIZE - buf_info->page_offset);
+			frag_len = min_t(u32, remain_len, IONIC_PAGE_SIZE - buf_info->page_offset);
 			sg_elem->len = cpu_to_le16(frag_len);
 			remain_len -= frag_len;
 			buf_info++;
-- 
2.39.1