Skip to contentSkip to conversation

net/cnxk: fix overrun when processing tail drop arg

PATCH In review Stephen Hemminger 2 participants 3 messages Sep 23, 2025 Network drivers

lore
Share & tools
lore
#0 lore raw

PATCH 1/2 net/cnxk: fix overrun when processing tail drop arg

If cnxk is compiled with LTO, compiler detects that the code to parse a flag is expecting to write 16 bit value into a one byte field.

In function ‘parse_flag’,
inlined from ‘kvargs_process_common’ at ../lib/kvargs/rte_kvargs.c:187:9,
inlined from ‘rte_kvargs_process’ at ../lib/kvargs/rte_kvargs.c:203:9,
inlined from ‘cnxk_ethdev_parse_devargs’ at ../drivers/net/cnxk/cnxk_ethdev_devargs.c:371:2:
../drivers/net/cnxk/cnxk_ethdev_devargs.c:166: warning: writing 2 bytes into a region of size 1 [-Wstringop-overflow=]
166 | *(uint16_t *)extra_args = atoi(value);
../drivers/net/cnxk/cnxk_ethdev_devargs.c: In function ‘cnxk_ethdev_parse_devargs’:
../drivers/net/cnxk/cnxk_ethdev_devargs.c:306:17: note: destination object ‘force_tail_drop’ of size 1
306 | uint8_t force_tail_drop = 0;
| ^

Bugzilla ID: 1790

Fixes 75473b5b62c3 ("net/cnxk: add option to force tail drop")
---
 drivers/net/cnxk/cnxk_ethdev_devargs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/cnxk/cnxk_ethdev_devargs.c +1 -1
index e42344a2ec..5d774e0d70 100644
@@ -303,7 +303,7 @@ cnxk_ethdev_parse_devargs(struct rte_devargs *devargs, struct cnxk_eth_dev *dev)
 	uint16_t outb_nb_desc = 8200;
 	struct sdp_channel sdp_chan;
 	uint16_t rss_tag_as_xor = 0;
-	uint8_t force_tail_drop = 0;
+	uint16_t force_tail_drop = 0;
 	uint16_t scalar_enable = 0;
 	uint16_t tx_compl_ena = 0;
 	uint16_t custom_sa_act = 0;
Signature · 1 line
2.47.3
#1 lore raw

PATCH 2/2 net/cnxk: fix overrun in dis_xqe_drop

The function parse_flag expects 16 bit value for flag, but dis_xqe_drop is a byte. Detected when LTO enabled as:

../drivers/net/cnxk/cnxk_ethdev_devargs.c:166: warning: writing 2 bytes into a region of size 1 [-Wstringop-overflow=]
166 | *(uint16_t *)extra_args = atoi(value);
../drivers/net/cnxk/cnxk_ethdev_devargs.c: In function ‘cnxk_ethdev_parse_devargs’:
../drivers/net/cnxk/cnxk_ethdev_devargs.c:312:17: note: destination object ‘dis_xqe_drop’ of size 1
312 | uint8_t dis_xqe_drop = 0;
| ^

Bugzilla ID: 1790

Fixes 0344fb5a59c2 ("net/cnxk: add option to disable XQE drop")
---
 drivers/net/cnxk/cnxk_ethdev_devargs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/cnxk/cnxk_ethdev_devargs.c +1 -1
index 5d774e0d70..68e6b1d190 100644
@@ -309,7 +309,7 @@ cnxk_ethdev_parse_devargs(struct rte_devargs *devargs, struct cnxk_eth_dev *dev)
 	uint16_t custom_sa_act = 0;
 	uint16_t custom_inb_sa = 0;
 	struct rte_kvargs *kvlist;
-	uint8_t dis_xqe_drop = 0;
+	uint16_t dis_xqe_drop = 0;
 	uint32_t meta_buf_sz = 0;
 	uint16_t lock_rx_ctx = 0;
 	uint16_t rx_inj_ena = 0;
Signature · 1 line
2.47.3
#2 lore raw

Re: [PATCH 2/2] net/cnxk: fix overrun in dis_xqe_drop

Quoted 11 lines · Stephen Hemminger

The function parse_flag expects 16 bit value for flag, but dis_xqe_drop is a byte. Detected when LTO enabled as:

../drivers/net/cnxk/cnxk_ethdev_devargs.c:166: warning: writing 2 bytes into a region of size 1 [-Wstringop-overflow=]
166 | *(uint16_t *)extra_args = atoi(value);
../drivers/net/cnxk/cnxk_ethdev_devargs.c: In function ‘cnxk_ethdev_parse_devargs’:
../drivers/net/cnxk/cnxk_ethdev_devargs.c:312:17: note: destination object ‘dis_xqe_drop’ of size 1
312 | uint8_t dis_xqe_drop = 0;
| ^

Quoted 6 lines

Bugzilla ID: 1790

Fixes 0344fb5a59c2 ("net/cnxk: add option to disable XQE drop")

Series applied to dpdk-next-net-mrvl/for-main after fixing following warnings.

Wrong headline format:
net/cnxk: fix overrun in dis_xqe_drop
Line too long:
inlined from ‘kvargs_process_common’ at
../lib/kvargs/rte_kvargs.c:187:9,
inlined from ‘cnxk_ethdev_parse_devargs’ at
../drivers/net/cnxk/cnxk_ethdev_devargs.c:371:2:

        ../drivers/net/cnxk/cnxk_ethdev_devargs.c:166: warning:
writing 2 bytes into a region of size 1 [-Wstringop-overflow=]
        ../drivers/net/cnxk/cnxk_ethdev_devargs.c: In function
‘cnxk_ethdev_parse_devargs’:
        ../drivers/net/cnxk/cnxk_ethdev_devargs.c:306:17: note:
destination object ‘force_tail_drop’ of size 1
        ../drivers/net/cnxk/cnxk_ethdev_devargs.c:166: warning:
writing 2 bytes into a region of size 1 [-Wstringop-overflow=]
        ../drivers/net/cnxk/cnxk_ethdev_devargs.c: In function
‘cnxk_ethdev_parse_devargs’:
        ../drivers/net/cnxk/cnxk_ethdev_devargs.c:312:17: note:

destination object ‘dis_xqe_drop’ of size 1

Invalid patch(es) found - checked 2 patches
check-git-log failed

### [PATCH] net/cnxk: fix overrun when processing tail drop arg

WARNING:COMMIT_LOG_LONG_LINE: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#14:
inlined from ‘kvargs_process_common’ at ../lib/kvargs/rte_kvargs.c:187:9,

total: 0 errors, 1 warnings, 0 checks, 8 lines check

Quoted 20 lines
---
 drivers/net/cnxk/cnxk_ethdev_devargs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/cnxk/cnxk_ethdev_devargs.c +1 -2
index 5d774e0d70..68e6b1d190 100644
@@ -309,7 +309,7 @@ cnxk_ethdev_parse_devargs(struct rte_devargs *devargs, struct cnxk_eth_dev *dev)
        uint16_t custom_sa_act = 0;
        uint16_t custom_inb_sa = 0;
        struct rte_kvargs *kvlist;
-       uint8_t dis_xqe_drop = 0;
+       uint16_t dis_xqe_drop = 0;
        uint32_t meta_buf_sz = 0;
        uint16_t lock_rx_ctx = 0;
        uint16_t rx_inj_ena = 0;
--

2.47.3