From 68b6e6e694faa7e76b3451da0d484a955dd6d103 Mon Sep 17 00:00:00 2001 From: John Daley Date: Mon, 12 Apr 2021 13:50:21 -0700 Subject: [PATCH] net/enic: fix completion pointer calculation The completion queue index could be implicitly extended past its uint16_t size when multiplied by the size of the descriptor. While this should not be a problem, coverity flags it. Do the extension explicitly by casting the index to uintptr_t. Coverity issue: 161317 Fixes: 8b428cb5a92e ("net/enic: use 64B completion queue entries if available") Cc: stable@dpdk.org Signed-off-by: John Daley Reviewed-by: Hyong Youb Kim --- drivers/net/enic/enic_rxtx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/enic/enic_rxtx.c b/drivers/net/enic/enic_rxtx.c index a2a02227e3..3899907d6d 100644 --- a/drivers/net/enic/enic_rxtx.c +++ b/drivers/net/enic/enic_rxtx.c @@ -70,7 +70,7 @@ enic_recv_pkts_common(void *rx_queue, struct rte_mbuf **rx_pkts, cq = &enic->cq[enic_cq_rq(enic, sop_rq->index)]; cq_idx = cq->to_clean; /* index of cqd, rqd, mbuf_table */ cqd_ptr = (struct cq_desc *)((uintptr_t)(cq->ring.descs) + - cq_idx * desc_size); + (uintptr_t)cq_idx * desc_size); color = cq->last_color; data_rq = &enic->rq[sop_rq->data_queue_idx]; @@ -126,7 +126,7 @@ enic_recv_pkts_common(void *rx_queue, struct rte_mbuf **rx_pkts, /* Prefetch next mbuf & desc while processing current one */ cqd_ptr = (struct cq_desc *)((uintptr_t)(cq->ring.descs) + - cq_idx * desc_size); + (uintptr_t)cq_idx * desc_size); rte_enic_prefetch(cqd_ptr); ciflags = enic_cq_rx_desc_ciflags( -- 2.20.1