From c6b552e4c0aaedf910ddae0345faee360394958b Mon Sep 17 00:00:00 2001 From: Michael Baum Date: Thu, 1 Jul 2021 09:39:15 +0300 Subject: [PATCH] vdpa/mlx5: fix overflow in queue attribute The mlx5_vdpa_event_qp_create function makes shifting to the numeric constant 1, then multiplies it by another constant and finally assigns it into a uint64_t variable. The numeric constant type is an int with a 32-bit sign. if after shifting , its MSB (bit of sign) will change, the uint64 variable will get into it a different value than what the function intended it to get. Set the numeric constant 1 to be uint64_t in the first place. Fixes: 8395927cdfaf ("vdpa/mlx5: prepare HW queues") Cc: stable@dpdk.org Signed-off-by: Michael Baum Acked-by: Matan Azrad --- drivers/vdpa/mlx5/mlx5_vdpa_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vdpa/mlx5/mlx5_vdpa_event.c b/drivers/vdpa/mlx5/mlx5_vdpa_event.c index 88f6a4256d..3541c652ce 100644 --- a/drivers/vdpa/mlx5/mlx5_vdpa_event.c +++ b/drivers/vdpa/mlx5/mlx5_vdpa_event.c @@ -629,8 +629,8 @@ mlx5_vdpa_event_qp_create(struct mlx5_vdpa_priv *priv, uint16_t desc_n, attr.wq_umem_id = eqp->umem_obj->umem_id; attr.wq_umem_offset = 0; attr.dbr_umem_id = eqp->umem_obj->umem_id; - attr.dbr_address = (1 << log_desc_n) * MLX5_WSEG_SIZE; attr.ts_format = mlx5_ts_format_conv(priv->qp_ts_format); + attr.dbr_address = RTE_BIT64(log_desc_n) * MLX5_WSEG_SIZE; eqp->sw_qp = mlx5_devx_cmd_create_qp(priv->ctx, &attr); if (!eqp->sw_qp) { DRV_LOG(ERR, "Failed to create SW QP(%u).", rte_errno); -- 2.20.1