patch 'net/cnxk: fix underflow in LSO calculation' has been queued to stable release 24.11.7
luca.boccassi at gmail.com
luca.boccassi at gmail.com
Mon Jul 6 12:20:15 CEST 2026
Hi,
FYI, your patch has been queued to stable release 24.11.7
Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/05/26. So please
shout if anyone has objections.
Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.
Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable
This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/b830aa0cc236b2514686a681b74373e99425485b
Thanks.
Luca Boccassi
---
>From b830aa0cc236b2514686a681b74373e99425485b Mon Sep 17 00:00:00 2001
From: Aarnav JP <ajp at marvell.com>
Date: Mon, 15 Jun 2026 21:54:38 +0530
Subject: [PATCH] net/cnxk: fix underflow in LSO calculation
[ upstream commit 9de65cf09f2c9bfdb232fed6166c4cf225674478 ]
Replace branchless mask-based selection with a ternary operator
to resolve Coverity integer underflow warning. The expression
-(!w1.il3type) assigned -1 to a uint64_t variable, which is
well-defined but flagged as an unsigned integer underflow.
Coverity issue: 502004
Fixes: 19f3af2371a7 ("net/cnxk: add Tx burst for CN10K")
Fixes: 39dc567c1955 ("net/cnxk: add Tx burst for CN9K")
Fixes: 006c1daa89b9 ("net/cnxk: support Tx burst scalar for CN20K")
Signed-off-by: Aarnav JP <ajp at marvell.com>
---
drivers/net/cnxk/cn10k_tx.h | 8 ++------
drivers/net/cnxk/cn20k_tx.h | 8 ++------
drivers/net/cnxk/cn9k_tx.h | 8 ++------
3 files changed, 6 insertions(+), 18 deletions(-)
diff --git a/drivers/net/cnxk/cn10k_tx.h b/drivers/net/cnxk/cn10k_tx.h
index 77f4e54cd8..e79bc6bc4d 100644
--- a/drivers/net/cnxk/cn10k_tx.h
+++ b/drivers/net/cnxk/cn10k_tx.h
@@ -1132,10 +1132,8 @@ cn10k_nix_xmit_prepare(struct cn10k_eth_txq *txq,
if (flags & NIX_TX_NEED_EXT_HDR && flags & NIX_TX_OFFLOAD_TSO_F &&
(ol_flags & RTE_MBUF_F_TX_TCP_SEG)) {
uint16_t lso_sb;
- uint64_t mask;
- mask = -(!w1.il3type);
- lso_sb = (mask & w1.ol4ptr) + (~mask & w1.il4ptr) + m->l4_len;
+ lso_sb = (w1.il3type ? w1.il4ptr : w1.ol4ptr) + m->l4_len;
send_hdr_ext->w0.lso_sb = lso_sb;
send_hdr_ext->w0.lso = 1;
@@ -1760,13 +1758,11 @@ cn10k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1,
const uint64_t flags, const uint64_t lso_tun_fmt)
{
uint16_t lso_sb;
- uint64_t mask;
if (!(ol_flags & RTE_MBUF_F_TX_TCP_SEG))
return;
- mask = -(!w1->il3type);
- lso_sb = (mask & w1->ol4ptr) + (~mask & w1->il4ptr) + m->l4_len;
+ lso_sb = (w1->il3type ? w1->il4ptr : w1->ol4ptr) + m->l4_len;
w0->u |= BIT(14);
w0->lso_sb = lso_sb;
diff --git a/drivers/net/cnxk/cn20k_tx.h b/drivers/net/cnxk/cn20k_tx.h
index 8c3ba8326d..8cfa2a8332 100644
--- a/drivers/net/cnxk/cn20k_tx.h
+++ b/drivers/net/cnxk/cn20k_tx.h
@@ -1105,10 +1105,8 @@ cn20k_nix_xmit_prepare(struct cn20k_eth_txq *txq, struct rte_mbuf *m, struct rte
if (flags & NIX_TX_NEED_EXT_HDR && flags & NIX_TX_OFFLOAD_TSO_F &&
(ol_flags & RTE_MBUF_F_TX_TCP_SEG)) {
uint16_t lso_sb;
- uint64_t mask;
- mask = -(!w1.il3type);
- lso_sb = (mask & w1.ol4ptr) + (~mask & w1.il4ptr) + m->l4_len;
+ lso_sb = (w1.il3type ? w1.il4ptr : w1.ol4ptr) + m->l4_len;
send_hdr_ext->w0.lso_sb = lso_sb;
send_hdr_ext->w0.lso = 1;
@@ -1720,13 +1718,11 @@ cn20k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1, union nix
uint64_t ol_flags, const uint64_t flags, const uint64_t lso_tun_fmt)
{
uint16_t lso_sb;
- uint64_t mask;
if (!(ol_flags & RTE_MBUF_F_TX_TCP_SEG))
return;
- mask = -(!w1->il3type);
- lso_sb = (mask & w1->ol4ptr) + (~mask & w1->il4ptr) + m->l4_len;
+ lso_sb = (w1->il3type ? w1->il4ptr : w1->ol4ptr) + m->l4_len;
w0->u |= BIT(14);
w0->lso_sb = lso_sb;
diff --git a/drivers/net/cnxk/cn9k_tx.h b/drivers/net/cnxk/cn9k_tx.h
index 902a17860c..ded8ddd3b5 100644
--- a/drivers/net/cnxk/cn9k_tx.h
+++ b/drivers/net/cnxk/cn9k_tx.h
@@ -477,10 +477,8 @@ cn9k_nix_xmit_prepare(struct cn9k_eth_txq *txq, struct rte_mbuf *m, struct rte_m
if (flags & NIX_TX_OFFLOAD_TSO_F && (ol_flags & RTE_MBUF_F_TX_TCP_SEG)) {
uint16_t lso_sb;
- uint64_t mask;
- mask = -(!w1.il3type);
- lso_sb = (mask & w1.ol4ptr) + (~mask & w1.il4ptr) + m->l4_len;
+ lso_sb = (w1.il3type ? w1.il4ptr : w1.ol4ptr) + m->l4_len;
send_hdr_ext->w0.lso_sb = lso_sb;
send_hdr_ext->w0.lso = 1;
@@ -876,13 +874,11 @@ cn9k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1,
uint64_t flags)
{
uint16_t lso_sb;
- uint64_t mask;
if (!(ol_flags & RTE_MBUF_F_TX_TCP_SEG))
return;
- mask = -(!w1->il3type);
- lso_sb = (mask & w1->ol4ptr) + (~mask & w1->il4ptr) + m->l4_len;
+ lso_sb = (w1->il3type ? w1->il4ptr : w1->ol4ptr) + m->l4_len;
w0->u |= BIT(14);
w0->lso_sb = lso_sb;
--
2.47.3
---
Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- - 2026-07-03 12:55:47.582699258 +0100
+++ 0023-net-cnxk-fix-underflow-in-LSO-calculation.patch 2026-07-03 12:55:46.630572933 +0100
@@ -1 +1 @@
-From 9de65cf09f2c9bfdb232fed6166c4cf225674478 Mon Sep 17 00:00:00 2001
+From b830aa0cc236b2514686a681b74373e99425485b Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 9de65cf09f2c9bfdb232fed6166c4cf225674478 ]
+
@@ -16 +17,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
-index 8c912a1f35..d5cb2c3294 100644
+index 77f4e54cd8..e79bc6bc4d 100644
@@ -29 +30 @@
-@@ -1138,10 +1138,8 @@ cn10k_nix_xmit_prepare(struct cn10k_eth_txq *txq,
+@@ -1132,10 +1132,8 @@ cn10k_nix_xmit_prepare(struct cn10k_eth_txq *txq,
@@ -41 +42 @@
-@@ -1766,13 +1764,11 @@ cn10k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1,
+@@ -1760,13 +1758,11 @@ cn10k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1,
@@ -57 +58 @@
-index 8e64d2e352..a1c71f2761 100644
+index 8c3ba8326d..8cfa2a8332 100644
@@ -60 +61 @@
-@@ -1117,10 +1117,8 @@ cn20k_nix_xmit_prepare(struct cn20k_eth_txq *txq, struct rte_mbuf *m, struct rte
+@@ -1105,10 +1105,8 @@ cn20k_nix_xmit_prepare(struct cn20k_eth_txq *txq, struct rte_mbuf *m, struct rte
@@ -72 +73 @@
-@@ -1732,13 +1730,11 @@ cn20k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1, union nix
+@@ -1720,13 +1718,11 @@ cn20k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1, union nix
@@ -88 +89 @@
-index 0ec448e36c..2f9b936d56 100644
+index 902a17860c..ded8ddd3b5 100644
@@ -91 +92 @@
-@@ -478,10 +478,8 @@ cn9k_nix_xmit_prepare(struct cn9k_eth_txq *txq, struct rte_mbuf *m, struct rte_m
+@@ -477,10 +477,8 @@ cn9k_nix_xmit_prepare(struct cn9k_eth_txq *txq, struct rte_mbuf *m, struct rte_m
@@ -103 +104 @@
-@@ -875,13 +873,11 @@ cn9k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1,
+@@ -876,13 +874,11 @@ cn9k_nix_prepare_tso(struct rte_mbuf *m, union nix_send_hdr_w1_u *w1,
More information about the stable
mailing list