LXONTXC and LXOFFTXC are 32-bit counters for transmitted XON and
XOFF packets. ixgbe_read_stats_registers() sums their deltas and uses
the result to adjust the transmitted byte counters by the minimum
Ethernet frame length.
The sum is currently computed as:
total = lxon + lxoff
Since both operands are 32-bit, the addition is performed in 32 bits
and may wrap before the result is stored in total. The wrapped value is
then used in the byte adjustment, which may make the software byte
counters incorrect.
Make total 64-bit and cast lxon before the addition so the XON/XOFF
packet sum and the following byte adjustment are computed without
32-bit overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Daniil Iskhakov <[email protected]>
---
Cc: [email protected]
Cc: [email protected]
---
drivers/net/intel/ixgbe/ixgbe_ethdev.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/intel/ixgbe/ixgbe_ethdev.c
b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
index 57d929cf2c..cff2dbd900 100644
--- a/drivers/net/intel/ixgbe/ixgbe_ethdev.c
+++ b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
@@ -3181,7 +3181,8 @@ ixgbe_read_stats_registers(struct ixgbe_hw *hw,
uint64_t *total_missed_rx, uint64_t *total_qbrc,
uint64_t *total_qprc, uint64_t *total_qprdc)
{
- uint32_t bprc, lxon, lxoff, total;
+ uint32_t bprc, lxon, lxoff;
+ uint64_t total;
uint32_t delta_gprc = 0;
unsigned i;
/* Workaround for RX byte count not including CRC bytes when CRC
@@ -3310,7 +3311,7 @@ ixgbe_read_stats_registers(struct ixgbe_hw *hw,
hw_stats->lxontxc += lxon;
lxoff = IXGBE_READ_REG(hw, IXGBE_LXOFFTXC);
hw_stats->lxofftxc += lxoff;
- total = lxon + lxoff;
+ total = (uint64_t)lxon + lxoff;
hw_stats->mptc += IXGBE_READ_REG(hw, IXGBE_MPTC);
hw_stats->ptc64 += IXGBE_READ_REG(hw, IXGBE_PTC64);
--
2.43.0
