diff mbox

[dpdk-dev] pmd_vmxnet3: Unintentional integer overflow

Message ID 1505821678-33651-1-git-send-email-sebastianx.basierski@intel.com (mailing list archive)
State Accepted, archived
Delegated to: Ferruh Yigit
Headers

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

SebastianX Basierski Sept. 19, 2017, 11:47 a.m. UTC 
  Fixed overflow by casting txq->cmd_ring.next2fill to uint64_t type.

Coverity issue: 143457

Fixes: 01fef6e3c181 ("net/vmxnet3: allow variable length Tx data ring")
Cc: skhare@vmware.com
cc: dev@dpdk.org

Signed-off-by: SebastianX Basierski <sebastianx.basierski@intel.com>
---
 drivers/net/vmxnet3/vmxnet3_rxtx.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Ferruh Yigit Sept. 19, 2017, 2:44 p.m. UTC | #1 
On 9/19/2017 12:47 PM, SebastianX Basierski wrote:
> Fixed overflow by casting txq->cmd_ring.next2fill to uint64_t type.
> 
> Coverity issue: 143457
> 
> Fixes: 01fef6e3c181 ("net/vmxnet3: allow variable length Tx data ring")
> Cc: skhare@vmware.com
> cc: dev@dpdk.org
> 
> Signed-off-by: SebastianX Basierski <sebastianx.basierski@intel.com>

Reviewed-by: Ferruh Yigit <ferruh.yigit@intel.com>
Ferruh Yigit Sept. 20, 2017, 4:13 p.m. UTC | #2 
On 9/19/2017 3:44 PM, Ferruh Yigit wrote:
> On 9/19/2017 12:47 PM, SebastianX Basierski wrote:
>> Fixed overflow by casting txq->cmd_ring.next2fill to uint64_t type.
>>
>> Coverity issue: 143457
>>
>> Fixes: 01fef6e3c181 ("net/vmxnet3: allow variable length Tx data ring")
Cc: stable@dpdk.org
>>
>> Signed-off-by: SebastianX Basierski <sebastianx.basierski@intel.com>
> 
> Reviewed-by: Ferruh Yigit <ferruh.yigit@intel.com>

Applied to dpdk-next-net/master, thanks.
diff mbox

Patch

diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
index d9cf437..680da17 100644
--- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
+++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
@@ -504,8 +504,9 @@  vmxnet3_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
 			 */
 			gdesc = txq->cmd_ring.base + txq->cmd_ring.next2fill;
 			if (copy_size) {
-				uint64 offset = txq->cmd_ring.next2fill *
-						txq->txdata_desc_size;
+				uint64 offset =
+					(uint64)txq->cmd_ring.next2fill *
+							txq->txdata_desc_size;
 				gdesc->txd.addr =
 					rte_cpu_to_le_64(txq->data_ring.basePA +
 							 offset);