Commit a7551b75 authored by Robert Love's avatar Robert Love Committed by David S. Miller

ixgbe: Don't allow user buffer count to exceed 256

If the user buffer count was 256 the shift would place a 1
in the offset region leading to errors. It also overwrites
the uers buffer list. This patch makes sure that at most
256 user buffers are allowed for DDP and the buffer count
is masked properly such that it doesn't overwrite the offset
when shifting the bits.
Signed-off-by: default avatarRobert Love <robert.w.love@intel.com>
Signed-off-by: default avatarYi Zou <yi.zou@intel.com>
Signed-off-by: default avatarFrank Zhang <frank_1.zhang@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e0fce695
...@@ -202,6 +202,15 @@ int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid, ...@@ -202,6 +202,15 @@ int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid,
addr = sg_dma_address(sg); addr = sg_dma_address(sg);
len = sg_dma_len(sg); len = sg_dma_len(sg);
while (len) { while (len) {
/* max number of buffers allowed in one DDP context */
if (j >= IXGBE_BUFFCNT_MAX) {
netif_err(adapter, drv, adapter->netdev,
"xid=%x:%d,%d,%d:addr=%llx "
"not enough descriptors\n",
xid, i, j, dmacount, (u64)addr);
goto out_noddp_free;
}
/* get the offset of length of current buffer */ /* get the offset of length of current buffer */
thisoff = addr & ((dma_addr_t)bufflen - 1); thisoff = addr & ((dma_addr_t)bufflen - 1);
thislen = min((bufflen - thisoff), len); thislen = min((bufflen - thisoff), len);
...@@ -227,20 +236,13 @@ int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid, ...@@ -227,20 +236,13 @@ int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid,
len -= thislen; len -= thislen;
addr += thislen; addr += thislen;
j++; j++;
/* max number of buffers allowed in one DDP context */
if (j > IXGBE_BUFFCNT_MAX) {
DPRINTK(DRV, ERR, "xid=%x:%d,%d,%d:addr=%llx "
"not enough descriptors\n",
xid, i, j, dmacount, (u64)addr);
goto out_noddp_free;
}
} }
} }
/* only the last buffer may have non-full bufflen */ /* only the last buffer may have non-full bufflen */
lastsize = thisoff + thislen; lastsize = thisoff + thislen;
fcbuff = (IXGBE_FCBUFF_4KB << IXGBE_FCBUFF_BUFFSIZE_SHIFT); fcbuff = (IXGBE_FCBUFF_4KB << IXGBE_FCBUFF_BUFFSIZE_SHIFT);
fcbuff |= (j << IXGBE_FCBUFF_BUFFCNT_SHIFT); fcbuff |= ((j & 0xff) << IXGBE_FCBUFF_BUFFCNT_SHIFT);
fcbuff |= (firstoff << IXGBE_FCBUFF_OFFSET_SHIFT); fcbuff |= (firstoff << IXGBE_FCBUFF_OFFSET_SHIFT);
fcbuff |= (IXGBE_FCBUFF_VALID); fcbuff |= (IXGBE_FCBUFF_VALID);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment