netdev - Re: [PATCH net v2] ionic: fix 16bit math issue when PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 15 Sep 2023 09:55:46 -0700
From: "Nelson, Shannon" <shannon.nelson@....com>
To: David Christensen <drc@....com>, brett.creeley@....com,
 drivers@...sando.io
Cc: netdev@...r.kernel.org, David Christensen <drc@...ux.vnet.ibm.com>
Subject: Re: [PATCH net v2] ionic: fix 16bit math issue when PAGE_SIZE >= 64KB

On 9/14/2023 3:02 PM, David Christensen wrote:
> 
> From: David Christensen <drc@...ux.vnet.ibm.com>
> 
> The ionic device supports a maximum buffer length of 16 bits (see
> ionic_rxq_desc or ionic_rxq_sg_elem).  When adding new buffers to
> the receive rings, the function ionic_rx_fill() uses 16bit math when
> calculating the number of pages to allocate for an RX descriptor,
> given the interface's MTU setting. If the system PAGE_SIZE >= 64KB,
> and the buf_info->page_offset is 0, the remain_len value will never
> decrement from the original MTU value and the frag_len value will
> always be 0, causing additional pages to be allocated as scatter-
> gather elements unnecessarily.
> 
> A similar math issue exists in ionic_rx_frags(), but no failures
> have been observed here since a 64KB page should not normally
> require any scatter-gather elements at any legal Ethernet MTU size.
> 
> Fixes: 4b0a7539a372 ("ionic: implement Rx page reuse")
> Signed-off-by: David Christensen <drc@...ux.vnet.ibm.com>

Thanks

Reviewed-by: Shannon Nelson <shannon.nelson@....com>

> ---
>   drivers/net/ethernet/pensando/ionic/ionic_dev.h  |  1 +
>   drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 10 +++++++---
>   2 files changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
> index 6aac98bcb9f4..aae4131f146a 100644
> --- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h
> +++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
> @@ -187,6 +187,7 @@ typedef void (*ionic_desc_cb)(struct ionic_queue *q,
>                                struct ionic_desc_info *desc_info,
>                                struct ionic_cq_info *cq_info, void *cb_arg);
> 
> +#define IONIC_MAX_BUF_LEN                      ((u16)-1)
>   #define IONIC_PAGE_SIZE                                PAGE_SIZE
>   #define IONIC_PAGE_SPLIT_SZ                    (PAGE_SIZE / 2)
>   #define IONIC_PAGE_GFP_MASK                    (GFP_ATOMIC | __GFP_NOWARN |\
> diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
> index 26798fc635db..44466e8c5d77 100644
> --- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
> +++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
> @@ -207,7 +207,8 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q,
>                          return NULL;
>                  }
> 
> -               frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);
> +               frag_len = min_t(u16, len, min_t(u32, IONIC_MAX_BUF_LEN,
> +                                                IONIC_PAGE_SIZE - buf_info->page_offset));
>                  len -= frag_len;
> 
>                  dma_sync_single_for_cpu(dev,
> @@ -452,7 +453,8 @@ void ionic_rx_fill(struct ionic_queue *q)
> 
>                  /* fill main descriptor - buf[0] */
>                  desc->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);
> -               frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);
> +               frag_len = min_t(u16, len, min_t(u32, IONIC_MAX_BUF_LEN,
> +                                                IONIC_PAGE_SIZE - buf_info->page_offset));
>                  desc->len = cpu_to_le16(frag_len);
>                  remain_len -= frag_len;
>                  buf_info++;
> @@ -471,7 +473,9 @@ void ionic_rx_fill(struct ionic_queue *q)
>                          }
> 
>                          sg_elem->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);
> -                       frag_len = min_t(u16, remain_len, IONIC_PAGE_SIZE - buf_info->page_offset);
> +                       frag_len = min_t(u16, remain_len, min_t(u32, IONIC_MAX_BUF_LEN,
> +                                                               IONIC_PAGE_SIZE -
> +                                                               buf_info->page_offset));
>                          sg_elem->len = cpu_to_le16(frag_len);
>                          remain_len -= frag_len;
>                          buf_info++;
> --
> 2.39.1
>