Mon, Mar 07, 2016 at 04:04:59PM IST, [email protected] wrote:
>Hello.
>
>On 3/7/2016 11:24 AM, Jiri Pirko wrote:
>
>> From: Ido Schimmel <[email protected]>
>>
>> The descriptor queues for sending (SDQs) and receiving (RDQs) packets
>> are managed by two counters - producer and consumer - which are both
>> 16-bit in size. A queue is considered full when the difference between
>> the two equals the queue's maximum number of descriptors.
>>
>> However, if the producer counter overflows, then it's possible for the
>> full queue check to fail, as it doesn't take the overflow into account.
>> In such a case, descriptors already passed to the device - but for which
>> a completion has yet to be posted - will be overwritten, thereby causing
>> undefined behavior. The above can be achieved under heavy load (~30
>> netperf instances).
>>
>> Fix that by casting the substraction result to u16, preventing it from
>
> Subtraction.
Will fix that in v2.
Thanks!
>
>> being treated as a signed integer.
>>
>> Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation")
>> Signed-off-by: Ido Schimmel <[email protected]>
>> Signed-off-by: Jiri Pirko <[email protected]>
>
>[...]
>
>MBR, Sergei
>
