ionic: fix 16bit math issue when PAGE_SIZE >= 64KB

The ionic device supports a maximum buffer length of 16 bits (see
ionic_rxq_desc or ionic_rxq_sg_elem).  When adding new buffers to
the receive rings, the function ionic_rx_fill() uses 16bit math when
calculating the number of pages to allocate for an RX descriptor,
given the interface's MTU setting. If the system PAGE_SIZE >= 64KB,
and the buf_info->page_offset is 0, the remain_len value will never
decrement from the original MTU value and the frag_len value will
always be 0, causing additional pages to be allocated as scatter-
gather elements unnecessarily.

A similar math issue exists in ionic_rx_frags(), but no failures
have been observed here since a 64KB page should not normally
require any scatter-gather elements at any legal Ethernet MTU size.

Fixes: 4b0a7539a372 ("ionic: implement Rx page reuse")
Signed-off-by: David Christensen <drc@linux.vnet.ibm.com>
Reviewed-by: Shannon Nelson <shannon.nelson@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
index 6aac98b..aae4131 100644 (file)
--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h
+++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
@@ -187,6 +187,7 @@ typedef void (*ionic_desc_cb)(struct ionic_queue *q,
                              struct ionic_desc_info *desc_info,
                              struct ionic_cq_info *cq_info, void *cb_arg);
 
+#define IONIC_MAX_BUF_LEN                      ((u16)-1)
 #define IONIC_PAGE_SIZE                                PAGE_SIZE
 #define IONIC_PAGE_SPLIT_SZ                    (PAGE_SIZE / 2)
 #define IONIC_PAGE_GFP_MASK                    (GFP_ATOMIC | __GFP_NOWARN |\

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
index 26798fc..44466e8 100644 (file)
--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
@@ -207,7 +207,8 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q,
                        return NULL;
                }
 
-               frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);
+               frag_len = min_t(u16, len, min_t(u32, IONIC_MAX_BUF_LEN,
+                                                IONIC_PAGE_SIZE - buf_info->page_offset));
                len -= frag_len;
 
                dma_sync_single_for_cpu(dev,
@@ -452,7 +453,8 @@ void ionic_rx_fill(struct ionic_queue *q)
 
                /* fill main descriptor - buf[0] */
                desc->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);
-               frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);
+               frag_len = min_t(u16, len, min_t(u32, IONIC_MAX_BUF_LEN,
+                                                IONIC_PAGE_SIZE - buf_info->page_offset));
                desc->len = cpu_to_le16(frag_len);
                remain_len -= frag_len;
                buf_info++;
@@ -471,7 +473,9 @@ void ionic_rx_fill(struct ionic_queue *q)
                        }
 
                        sg_elem->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);
-                       frag_len = min_t(u16, remain_len, IONIC_PAGE_SIZE - buf_info->page_offset);
+                       frag_len = min_t(u16, remain_len, min_t(u32, IONIC_MAX_BUF_LEN,
+                                                               IONIC_PAGE_SIZE -
+                                                               buf_info->page_offset));
                        sg_elem->len = cpu_to_le16(frag_len);
                        remain_len -= frag_len;
                        buf_info++;