From c87bc83a33d2cd0f159b175336553d5b3293aef0 Mon Sep 17 00:00:00 2001 From: Michael Baum Date: Thu, 1 Jul 2021 09:39:14 +0300 Subject: [PATCH] compress/mlx5: fix overflow in queue size The mlx5_compress_qp_setup function makes shifting to the numeric constant 1, then sends it as a parameter to rte_calloc function. The rte_calloc function expects to get size_t (might be 64 bit) and instead gets a 32-bit variable, because the numeric constant size is a 32-bit. In case the shift is greater than 32 bit and it 64-system, the variable will lose its value even though the function can get 64-bit argument. Change the size of the numeric constant 1 to size_t. Fixes: 8619fcd5161b ("compress/mlx5: support queue pair operations") Cc: stable@dpdk.org Signed-off-by: Michael Baum Acked-by: Matan Azrad --- drivers/compress/mlx5/mlx5_compress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/compress/mlx5/mlx5_compress.c b/drivers/compress/mlx5/mlx5_compress.c index 9775c81789..5c2b9dc859 100644 --- a/drivers/compress/mlx5/mlx5_compress.c +++ b/drivers/compress/mlx5/mlx5_compress.c @@ -207,7 +207,7 @@ mlx5_compress_qp_setup(struct rte_compressdev *dev, uint16_t qp_id, return -rte_errno; } dev->data->queue_pairs[qp_id] = qp; - opaq_buf = rte_calloc(__func__, 1u << log_ops_n, + opaq_buf = rte_calloc(__func__, (size_t)1 << log_ops_n, sizeof(struct mlx5_gga_compress_opaque), sizeof(struct mlx5_gga_compress_opaque)); if (opaq_buf == NULL) { -- 2.20.1