mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-29 23:53:32 +00:00
Code Issues Releases Wiki Activity

mlxsw: pci: Correctly determine if descriptor queue is full

Browse source 
The descriptor queues for sending (SDQs) and receiving (RDQs) packets
are managed by two counters - producer and consumer - which are both
16-bit in size. A queue is considered full when the difference between
the two equals the queue's maximum number of descriptors.

However, if the producer counter overflows, then it's possible for the
full queue check to fail, as it doesn't take the overflow into account.
In such a case, descriptors already passed to the device - but for which
a completion has yet to be posted - will be overwritten, thereby causing
undefined behavior. The above can be achieved under heavy load (~30
netperf instances).

Fix that by casting the subtraction result to u16, preventing it from
being treated as a signed integer.

Fixes: eda6500a98 ("mlxsw: Add PCI bus implementation")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ido Schimmel 2016-03-07 15:15:30 +01:00 committed by David S. Miller
parent 912b1c89c5
commit 5091730d77
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/net/ethernet/mellanox/mlxsw/pci.c
View file

@ -215,7 +215,7 @@ mlxsw_pci_queue_elem_info_producer_get(struct mlxsw_pci_queue *q)
{ {
int index = q->producer_counter & (q->count - 1); int index = q->producer_counter & (q->count - 1);
if ((q->producer_counter - q->consumer_counter) == q->count) if ((u16) (q->producer_counter - q->consumer_counter) == q->count)
return NULL; return NULL;
return mlxsw_pci_queue_elem_info_get(q, index); return mlxsw_pci_queue_elem_info_get(q, index);
} }