netdev - Re: [PATCH] ionic: fix 16bit math issue when PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 11 Sep 2023 17:14:42 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: David Christensen <drc@...ux.vnet.ibm.com>, <shannon.nelson@....com>,
	<brett.creeley@....com>, <drivers@...sando.io>
CC: <netdev@...r.kernel.org>
Subject: Re: [PATCH] ionic: fix 16bit math issue when PAGE_SIZE >= 64KB



On 9/11/2023 3:22 PM, David Christensen wrote:
> The function ionic_rx_fill() uses 16bit math when calculating the
> the number of pages required for an RX descriptor given an interface
> MTU setting. If the system PAGE_SIZE >= 64KB, the frag_len and
> remain_len values will always be 0, causing unnecessary scatter-
> gather elements to be assigned to the RX descriptor, up to the
> maximum number of scatter-gather elements per descriptor.
> 
> A similar change in ionic_rx_frags() is implemented for symmetry,
> but has not been observed as an issue since scatter-gather
> elements are not necessary for such larger page sizes.
> 
> Fixes: 4b0a7539a372 ("ionic: implement Rx page reuse")
> Signed-off-by: David Christensen <drc@...ux.vnet.ibm.com>
> ---

Given this is a bug fix, it should probably have a subject of [PATCH
net] or [net] to indicate its targeting the net tree.

I'm not sure I follow the logic for frag_len and remain_len always being
zero, since typecasting unsigned values truncates the higher bytes
(technically its guaranteed by the standard to result in the smallest
value congruent modulo 2^16 for a 16bit typecast), so if page_offset was
non-zero then the resulting with the typecast should be as well.. but
either way its definitely not going to work as desired.

Reviewed-by: Jacob Keller <jacob.e.keller@...el.com>

>  drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
> index 26798fc635db..56502bc80e01 100644
> --- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
> +++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
> @@ -182,8 +182,8 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q,
>  	struct device *dev = q->dev;
>  	struct sk_buff *skb;
>  	unsigned int i;
> -	u16 frag_len;
> -	u16 len;
> +	u32 frag_len;
> +	u32 len;
>  
>  	stats = q_to_rx_stats(q);
>  
> @@ -207,7 +207,7 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q,
>  			return NULL;
>  		}
>  
> -		frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);
> +		frag_len = min_t(u32, len, IONIC_PAGE_SIZE - buf_info->page_offset);
>  		len -= frag_len;
>  



>  		dma_sync_single_for_cpu(dev,
> @@ -452,7 +452,7 @@ void ionic_rx_fill(struct ionic_queue *q)
>  
>  		/* fill main descriptor - buf[0] */
>  		desc->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);
> -		frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);
> +		frag_len = min_t(u32, len, IONIC_PAGE_SIZE - buf_info->page_offset);
>  		desc->len = cpu_to_le16(frag_len);
>  		remain_len -= frag_len;
>  		buf_info++;
> @@ -471,7 +471,7 @@ void ionic_rx_fill(struct ionic_queue *q)
>  			}
>  
>  			sg_elem->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);
> -			frag_len = min_t(u16, remain_len, IONIC_PAGE_SIZE - buf_info->page_offset);
> +			frag_len = min_t(u32, remain_len, IONIC_PAGE_SIZE - buf_info->page_offset);
>  			sg_elem->len = cpu_to_le16(frag_len);
>  			remain_len -= frag_len;
>  			buf_info++;