{"id":2220955,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2220955/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/patch/20260408131154.2661818-7-aleksandr.loktionov@intel.com/","project":{"id":46,"url":"http://patchwork.ozlabs.org/api/1.1/projects/46/?format=json","name":"Intel Wired Ethernet development","link_name":"intel-wired-lan","list_id":"intel-wired-lan.osuosl.org","list_email":"intel-wired-lan@osuosl.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260408131154.2661818-7-aleksandr.loktionov@intel.com>","date":"2026-04-08T13:11:54","name":"[iwl-net,v2,6/6] ixgbe: fix integer overflow and wrong bit position in ixgbe_validate_rtr()","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"0043c5c0c2387ac6b67c07ae48adbf208e6a7bd5","submitter":{"id":75597,"url":"http://patchwork.ozlabs.org/api/1.1/people/75597/?format=json","name":"Loktionov, Aleksandr","email":"aleksandr.loktionov@intel.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/intel-wired-lan/patch/20260408131154.2661818-7-aleksandr.loktionov@intel.com/mbox/","series":[{"id":499139,"url":"http://patchwork.ozlabs.org/api/1.1/series/499139/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/list/?series=499139","date":"2026-04-08T13:11:48","name":"ixgbe: six bug fixes","version":2,"mbox":"http://patchwork.ozlabs.org/series/499139/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2220955/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2220955/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=osuosl.org header.i=@osuosl.org header.a=rsa-sha256\n header.s=default header.b=RjSZiuF/;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=osuosl.org\n (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org;\n envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frNkz2FSKz1yD6\n\tfor ; Wed, 08 Apr 2026 23:12:11 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id EE828608DA;\n\tWed, 8 Apr 2026 13:12:09 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id 8UjoRkjAXBif; Wed, 8 Apr 2026 13:12:08 +0000 (UTC)","from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 78435608A8;\n\tWed, 8 Apr 2026 13:12:08 +0000 (UTC)","from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136])\n by lists1.osuosl.org (Postfix) with ESMTP id 08D2D1F6\n for ; Wed, 8 Apr 2026 13:12:07 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp3.osuosl.org (Postfix) with ESMTP id E2FD860856\n for ; Wed, 8 Apr 2026 13:12:06 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id u-ahTul5ZtNJ for ;\n Wed, 8 Apr 2026 13:12:06 +0000 (UTC)","from mgamail.intel.com (mgamail.intel.com [192.198.163.7])\n by smtp3.osuosl.org (Postfix) with ESMTPS id 01A10608DC\n for ; Wed, 8 Apr 2026 13:12:05 +0000 (UTC)","from orviesa007.jf.intel.com ([10.64.159.147])\n by fmvoesa101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384;\n 08 Apr 2026 06:12:06 -0700","from amlin-019-225.igk.intel.com ([10.102.19.225])\n by orviesa007.jf.intel.com with ESMTP; 08 Apr 2026 06:12:04 -0700"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.166.142;\n helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp3.osuosl.org 78435608A8","OpenDKIM Filter v2.11.0 smtp3.osuosl.org 01A10608DC"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org;\n\ts=default; t=1775653928;\n\tbh=W+pWATUNZk4D+OO26ouISPU5lJBGjrPH0dGQjX2U0rQ=;\n\th=From:To:Cc:Date:In-Reply-To:References:Subject:List-Id:\n\t List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:\n\t From;\n\tb=RjSZiuF/23lQ2LesfxReI/OF0D2tA1aXDrfcoXvRWRrfxKMwZcGRx2GvwmRRmxzR3\n\t TEBaJyXJB24XWIeyBw/QRPGtggDmLR1qWWrsA3s5iBqPvHSelGlgINBjdOT5XwX5VL\n\t 1TP7S2DOfdiNoZ3rJjL5mj7KuOdkVpNZlh1JHTXWck+NUvfsx98DZNcWBEoJngRR3O\n\t jsfPVkabQV9lN8AKLHbxLFPku4/v8ykkvvoc6InK7ATY+5GX8UiZTxCaZ9+VRHNr+H\n\t mLJ2aHAIK2MV/4Ir7FZNu++uwYhvMuuwyjVVgcLWfl18amLZDTWgj9PbdLSZbmjlH1\n\t vTLjxuKdSvg1Q==","Received-SPF":"Pass (mailfrom) identity=mailfrom; client-ip=192.198.163.7;\n helo=mgamail.intel.com; envelope-from=aleksandr.loktionov@intel.com;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp3.osuosl.org 01A10608DC","X-CSE-ConnectionGUID":["8oh+R3nrSoqgRwbkvBMxZw==","UoruqNZeSIK/gIMoqZhRJw=="],"X-CSE-MsgGUID":["DlKJ42DdT7OzT3Jwr3zlNQ==","Ajq+f5wrTI+FO0oDjwlMYQ=="],"X-IronPort-AV":["E=McAfee;i=\"6800,10657,11752\"; a=\"102087241\"","E=Sophos;i=\"6.23,167,1770624000\"; d=\"scan'208\";a=\"102087241\"","E=Sophos;i=\"6.23,167,1770624000\"; d=\"scan'208\";a=\"228714985\""],"X-ExtLoop1":"1","From":"Aleksandr Loktionov ","To":"intel-wired-lan@lists.osuosl.org, anthony.l.nguyen@intel.com,\n aleksandr.loktionov@intel.com","Cc":"netdev@vger.kernel.org","Date":"Wed, 8 Apr 2026 15:11:54 +0200","Message-ID":"<20260408131154.2661818-7-aleksandr.loktionov@intel.com>","X-Mailer":"git-send-email 2.52.0","In-Reply-To":"<20260408131154.2661818-1-aleksandr.loktionov@intel.com>","References":"<20260408131154.2661818-1-aleksandr.loktionov@intel.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-Mailman-Original-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple;\n d=intel.com; i=@intel.com; q=dns/txt; s=Intel;\n t=1775653926; x=1807189926;\n h=from:to:cc:subject:date:message-id:in-reply-to:\n references:mime-version:content-transfer-encoding;\n bh=LU06K51Gotx2bmJxCVz4VDn41OARIsR6jwdtt19pDGM=;\n b=NiK70kGWmOI8RFJImbFKvRsbV+BNGhzxMGF9td/k/2ZxokXh5KhYszom\n u4YnGjFoVgrhtPIz9Mf97DnKWeWfXEwvKP1gLeUOdFwgi3eq4EZhphfXO\n EVYbNFX1bbramneOiE9kDAcXF3Av6jykxuw2IkcV7yrcCCg5/BEKiPjwL\n FSYDJRVAEtwOKDzhjUucY9DgyLRj3BTCfA8/YzxHe45dGcbG30Kg+hnTQ\n iag9xiCHUv5aCz+Ap/BfNwXOzKASUpG/GEIh8od+2iweb61OzQnmzbfxN\n pRBmSUv54Readd7iv4SmCE3C2nnLrxbcWPmIxxz8yB+hKoSK96QHQSD8S\n A==;","X-Mailman-Original-Authentication-Results":["smtp3.osuosl.org;\n dmarc=pass (p=none dis=none)\n header.from=intel.com","smtp3.osuosl.org;\n dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com\n header.a=rsa-sha256 header.s=Intel header.b=NiK70kGW"],"Subject":"[Intel-wired-lan] [PATCH iwl-net v2 6/6] ixgbe: fix integer\n overflow and wrong bit position in ixgbe_validate_rtr()","X-BeenThere":"intel-wired-lan@osuosl.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Intel Wired Ethernet Linux Kernel Driver Development\n ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"intel-wired-lan-bounces@osuosl.org","Sender":"\"Intel-wired-lan\" "},"content":"Two bugs in the same loop in ixgbe_validate_rtr():\n\n1. The 3-bit traffic-class field was extracted by shifting a u32 and\n assigning the result directly to a u8. For user priority 0 this is\n harmless; for UP[5..7] the shift leaves bits [15..21] in the u32\n which are then silently truncated when stored in u8. Mask with\n IXGBE_RTRUP2TC_UP_MASK before the assignment so only the intended\n 3 bits are kept.\n\n2. When clearing an out-of-bounds entry the mask was always shifted by\n the fixed constant IXGBE_RTRUP2TC_UP_SHIFT (== 3), regardless of\n which loop iteration was being processed. This means only UP1 (bit\n position 3) was ever cleared; UP0,2..7 (positions 0, 6, 9, ..., 21)\n were left unreset, so invalid TC mappings persisted in hardware and\n could mis-steer received packets to the wrong traffic class.\n Use i * IXGBE_RTRUP2TC_UP_SHIFT to target the correct 3-bit field\n for each iteration.\n\nSwap the operand order in the mask expression to place the constant\non the right per kernel coding style (noted by David Laight).\n\nFixes: e7589eab9291 (\"ixgbe: consolidate, setup for multiple traffic classes\")\nCc: stable@vger.kernel.org\nSigned-off-by: Aleksandr Loktionov \n---\nv1 -> v2:\n - Add Fixes: tag; reroute to iwl-net (wrong bit positions cause packet\n mis-steering); swap to (reg >> ...) & MASK operand order per David\n Laight.\n\n drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 5 +++--\n 1 file changed, 3 insertions(+), 2 deletions(-)","diff":"diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c\nindex 210c7b9..c9e4f12 100644\n--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c\n+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c\n@@ -9772,11 +9772,12 @@ static void ixgbe_validate_rtr(struct ixgbe_adapter *adapter, u8 tc)\n \trsave = reg;\n \n \tfor (i = 0; i < MAX_TRAFFIC_CLASS; i++) {\n-\t\tu8 up2tc = reg >> (i * IXGBE_RTRUP2TC_UP_SHIFT);\n+\t\tu8 up2tc = (reg >> (i * IXGBE_RTRUP2TC_UP_SHIFT)) &\n+\t\t\t IXGBE_RTRUP2TC_UP_MASK;\n \n \t\t/* If up2tc is out of bounds default to zero */\n \t\tif (up2tc > tc)\n-\t\t\treg &= ~(0x7 << IXGBE_RTRUP2TC_UP_SHIFT);\n+\t\t\treg &= ~(IXGBE_RTRUP2TC_UP_MASK << (i * IXGBE_RTRUP2TC_UP_SHIFT));\n \t}\n \n \tif (reg != rsave)\n","prefixes":["iwl-net","v2","6/6"]}