ixgbe_update_itr() packs a mode flag (IXGBE_ITR_ADAPTIVE_LATENCY, bit 7)
and a usecs delay (bits [6:0]) into an unsigned int, then stores it in
ring_container->itr which is u8. Values above 0xFF wrap, corrupting both
the delay and the mode-flag on the next readback.
Separate the mode bits from the usecs sub-field; clamp only the latter to
[0, IXGBE_ITR_ADAPTIVE_LATENCY - 1] via min_t(unsigned int, ...) so
overflow cannot bleed into bit 7. Add a WARN_ONCE() when the raw usecs
value exceeds U8_MAX so out-of-range ITR computations are visible in
dmesg during development and testing.
Fixes: b4ded8327fea ("ixgbe: Update adaptive ITR algorithm")
Signed-off-by: Aleksandr Loktionov <[email protected]>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 1885fe8..4d53bd63 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -2901,8 +2901,12 @@ static void ixgbe_update_itr(struct ixgbe_q_vector
*q_vector,
if ((itr & IXGBE_ITR_ADAPTIVE_LATENCY) && itr < ring_container->itr)
itr = ring_container->itr - IXGBE_ITR_ADAPTIVE_MIN_INC;
clear_counts:
- /* write back value */
- ring_container->itr = itr;
+ WARN_ONCE((itr & ~IXGBE_ITR_ADAPTIVE_LATENCY) > U8_MAX,
+ "ITR value %u exceeds U8_MAX, clamping\n", itr);
+
+ ring_container->itr = (itr & IXGBE_ITR_ADAPTIVE_LATENCY) |
+ min_t(unsigned int, itr & ~IXGBE_ITR_ADAPTIVE_LATENCY,
+ IXGBE_ITR_ADAPTIVE_LATENCY - 1);
/* next update should occur within next jiffy */
ring_container->next_update = next_update + 1;
--
2.52.0
