diff mbox series

[v1,net,1/4] net: ena: Fix potential sign extension issue

Message ID 20240410091358.16289-2-darinzon@amazon.com (mailing list archive)
State Accepted
Commit 713a85195aad25d8a26786a37b674e3e5ec09e3c
Delegated to: Netdev Maintainers
Headers show
Series ENA driver bug fixes | expand

Checks

Context Check Description
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Clearly marked for net
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag present in non-next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 942 this patch: 942
netdev/build_tools success No tools touched, skip
netdev/cc_maintainers warning 2 maintainers not CCed: pabeni@redhat.com edumazet@google.com
netdev/build_clang success Errors and warnings before: 953 this patch: 953
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn success Errors and warnings before: 953 this patch: 953
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 8 lines checked
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
netdev/contest success net-next-2024-04-11--00-00 (tests: 959)

Commit Message

Arinzon, David April 10, 2024, 9:13 a.m. UTC 
From: David Arinzon <darinzon@amazon.com>

Small unsigned types are promoted to larger signed types in
the case of multiplication, the result of which may overflow.
In case the result of such a multiplication has its MSB
turned on, it will be sign extended with '1's.
This changes the multiplication result.

Code example of the phenomenon:
-------------------------------
u16 x, y;
size_t z1, z2;

x = y = 0xffff;
printk("x=%x y=%x\n",x,y);

z1 = x*y;
z2 = (size_t)x*y;

printk("z1=%lx z2=%lx\n", z1, z2);

Output:
-------
x=ffff y=ffff
z1=fffffffffffe0001 z2=fffe0001

The expected result of ffff*ffff is fffe0001, and without the
explicit casting to avoid the unwanted sign extension we got
fffffffffffe0001.

This commit adds an explicit casting to avoid the sign extension
issue.

Fixes: 689b2bdaaa14 ("net: ena: add functions for handling Low Latency Queues in ena_com")
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David Arinzon <darinzon@amazon.com>
---
 drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Nelson, Shannon April 10, 2024, 9:49 p.m. UTC | #1 
On 4/10/2024 2:13 AM, darinzon@amazon.com wrote:
> Caution: This message originated from an External Source. Use proper caution when opening attachments, clicking links, or responding.
> 
> 
> From: David Arinzon <darinzon@amazon.com>
> 
> Small unsigned types are promoted to larger signed types in
> the case of multiplication, the result of which may overflow.
> In case the result of such a multiplication has its MSB
> turned on, it will be sign extended with '1's.
> This changes the multiplication result.
> 
> Code example of the phenomenon:
> -------------------------------
> u16 x, y;
> size_t z1, z2;
> 
> x = y = 0xffff;
> printk("x=%x y=%x\n",x,y);
> 
> z1 = x*y;
> z2 = (size_t)x*y;
> 
> printk("z1=%lx z2=%lx\n", z1, z2);
> 
> Output:
> -------
> x=ffff y=ffff
> z1=fffffffffffe0001 z2=fffe0001
> 
> The expected result of ffff*ffff is fffe0001, and without the
> explicit casting to avoid the unwanted sign extension we got
> fffffffffffe0001.
> 
> This commit adds an explicit casting to avoid the sign extension
> issue.
> 
> Fixes: 689b2bdaaa14 ("net: ena: add functions for handling Low Latency Queues in ena_com")
> Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
> Signed-off-by: David Arinzon <darinzon@amazon.com>

Reviewed-by: Shannon Nelson <shannon.nelson@amd.com>

> ---
>   drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
> index 9e9e4a03..2d8a66ea 100644
> --- a/drivers/net/ethernet/amazon/ena/ena_com.c
> +++ b/drivers/net/ethernet/amazon/ena/ena_com.c
> @@ -351,7 +351,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev,
>                          ENA_COM_BOUNCE_BUFFER_CNTRL_CNT;
>                  io_sq->bounce_buf_ctrl.next_to_use = 0;
> 
> -               size = io_sq->bounce_buf_ctrl.buffer_size *
> +               size = (size_t)io_sq->bounce_buf_ctrl.buffer_size *
>                          io_sq->bounce_buf_ctrl.buffers_num;
> 
>                  dev_node = dev_to_node(ena_dev->dmadev);
> --
> 2.40.1
> 
>
diff mbox series

Patch

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 9e9e4a03..2d8a66ea 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -351,7 +351,7 @@  static int ena_com_init_io_sq(struct ena_com_dev *ena_dev,
 			ENA_COM_BOUNCE_BUFFER_CNTRL_CNT;
 		io_sq->bounce_buf_ctrl.next_to_use = 0;
 
-		size = io_sq->bounce_buf_ctrl.buffer_size *
+		size = (size_t)io_sq->bounce_buf_ctrl.buffer_size *
 			io_sq->bounce_buf_ctrl.buffers_num;
 
 		dev_node = dev_to_node(ena_dev->dmadev);