From: Sebastian Basierski Date: Tue, 19 Sep 2017 11:47:58 +0000 (+0200) Subject: net/vmxnet3: fix unintentional integer overflow X-Git-Tag: spdx-start~1886 X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=e8c1642a3ce7517d8c974ed16446d5fc2c917e39;p=dpdk.git net/vmxnet3: fix unintentional integer overflow Fixed overflow by casting txq->cmd_ring.next2fill to uint64_t type. Coverity issue: 143457 Fixes: 01fef6e3c181 ("net/vmxnet3: allow variable length Tx data ring") Cc: stable@dpdk.org Signed-off-by: Sebastian Basierski Reviewed-by: Ferruh Yigit --- diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c index 9861d35001..d08f5eb22c 100644 --- a/drivers/net/vmxnet3/vmxnet3_rxtx.c +++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c @@ -504,8 +504,9 @@ vmxnet3_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts, */ gdesc = txq->cmd_ring.base + txq->cmd_ring.next2fill; if (copy_size) { - uint64 offset = txq->cmd_ring.next2fill * - txq->txdata_desc_size; + uint64 offset = + (uint64)txq->cmd_ring.next2fill * + txq->txdata_desc_size; gdesc->txd.addr = rte_cpu_to_le_64(txq->data_ring.basePA + offset);