From: Rita Ruvinsky <rita.ruvinsky@weka.io>
To: dev@dpdk.org
Cc: longli@microsoft.com, weh@microsoft.com,
Rita Ruvinsky <rita.ruvinsky@weka.io>,
stable@dpdk.org
Subject: [PATCH 1/2] net/mana: fix MR length truncation for chunks over 4GB
Date: Wed, 5 Aug 2026 18:44:06 +0300 [thread overview]
Message-ID: <20260805154407.1965063-1-rita.ruvinsky@weka.io> (raw)
mana_range.len is a uint32_t, so a mempool chunk of 4GB or more
truncates modulo 2^32 -- exactly 4GB becomes 0, 15GB becomes 3GB.
The guard against priv->max_mr_size cannot catch this because it
compares the already-truncated value, and the device advertises
max_mr_size as UINT64_MAX. ibv_reg_mr() then fails with EINVAL on a
zero length, or silently registers a region far shorter than the pool,
so lookups for buffers past that boundary never find an MR and no Rx
WQE can be posted.
Widen the length to uint64_t through the MR path, including the
multi-process request that forwards it to the primary process.
Fixes: 0f5db3c68ba7 ("net/mana: implement memory registration")
Cc: stable@dpdk.org
Signed-off-by: Rita Ruvinsky <rita.ruvinsky@weka.io>
---
drivers/net/mana/mana.h | 4 ++--
drivers/net/mana/mp.c | 4 ++--
drivers/net/mana/mr.c | 11 ++++++-----
3 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/net/mana/mana.h b/drivers/net/mana/mana.h
index 7d94840dc4..552865ff9d 100644
--- a/drivers/net/mana/mana.h
+++ b/drivers/net/mana/mana.h
@@ -553,7 +553,7 @@ struct mana_mp_param {
/* MANA_MP_REQ_CREATE_MR */
uintptr_t addr;
- uint32_t len;
+ uint64_t len;
};
#define MANA_MP_NAME "net_mana_mp"
@@ -562,7 +562,7 @@ int mana_mp_init_secondary(void);
void mana_mp_uninit_primary(void);
void mana_mp_uninit_secondary(void);
int mana_mp_req_verbs_cmd_fd(struct rte_eth_dev *dev);
-int mana_mp_req_mr_create(struct mana_priv *priv, uintptr_t addr, uint32_t len);
+int mana_mp_req_mr_create(struct mana_priv *priv, uintptr_t addr, uint64_t len);
void mana_mp_req_on_rxtx(struct rte_eth_dev *dev, enum mana_mp_req_type type);
diff --git a/drivers/net/mana/mp.c b/drivers/net/mana/mp.c
index 5467d385ce..5cc29de3a1 100644
--- a/drivers/net/mana/mp.c
+++ b/drivers/net/mana/mp.c
@@ -17,7 +17,7 @@ extern struct mana_shared_data *mana_shared_data;
* Process MR request from secondary process.
*/
static int
-mana_mp_mr_create(struct mana_priv *priv, uintptr_t addr, uint32_t len)
+mana_mp_mr_create(struct mana_priv *priv, uintptr_t addr, uint64_t len)
{
struct ibv_mr *ibv_mr;
int ret;
@@ -257,7 +257,7 @@ mana_mp_req_verbs_cmd_fd(struct rte_eth_dev *dev)
* Request the primary process to register a MR.
*/
int
-mana_mp_req_mr_create(struct mana_priv *priv, uintptr_t addr, uint32_t len)
+mana_mp_req_mr_create(struct mana_priv *priv, uintptr_t addr, uint64_t len)
{
struct rte_mp_msg mp_req = {0};
struct rte_mp_msg *mp_res;
diff --git a/drivers/net/mana/mr.c b/drivers/net/mana/mr.c
index c4045141bc..7405755df8 100644
--- a/drivers/net/mana/mr.c
+++ b/drivers/net/mana/mr.c
@@ -13,7 +13,8 @@
struct mana_range {
uintptr_t start;
uintptr_t end;
- uint32_t len;
+ /* 64-bit: a mempool chunk can be 4GB or more, which overflows uint32_t. */
+ uint64_t len;
};
void
@@ -47,13 +48,13 @@ mana_new_pmd_mr(struct mana_mr_btree *local_tree, struct mana_priv *priv,
for (i = 0; i < pool->nb_mem_chunks; i++) {
if (ranges[i].len > priv->max_mr_size) {
- DP_LOG(ERR, "memory chunk size %u exceeding max MR",
+ DP_LOG(ERR, "memory chunk size %" PRIu64 " exceeding max MR",
ranges[i].len);
return -ENOMEM;
}
DP_LOG(DEBUG,
- "registering memory chunk start 0x%" PRIxPTR " len %u",
+ "registering memory chunk start 0x%" PRIxPTR " len %" PRIu64,
ranges[i].start, ranges[i].len);
if (rte_eal_process_type() == RTE_PROC_SECONDARY) {
@@ -62,7 +63,7 @@ mana_new_pmd_mr(struct mana_mr_btree *local_tree, struct mana_priv *priv,
ranges[i].len);
if (ret) {
DP_LOG(ERR,
- "MR failed start 0x%" PRIxPTR " len %u",
+ "MR failed start 0x%" PRIxPTR " len %" PRIu64,
ranges[i].start, ranges[i].len);
return ret;
}
@@ -98,7 +99,7 @@ mana_new_pmd_mr(struct mana_mr_btree *local_tree, struct mana_priv *priv,
return ret;
}
} else {
- DP_LOG(ERR, "MR failed at 0x%" PRIxPTR " len %u",
+ DP_LOG(ERR, "MR failed at 0x%" PRIxPTR " len %" PRIu64,
ranges[i].start, ranges[i].len);
return -errno;
}
--
2.43.0
next reply other threads:[~2026-08-06 13:51 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-05 15:44 Rita Ruvinsky [this message]
2026-08-05 15:44 ` [PATCH 2/2] net/mana: fix double free of mbuf on Rx WQE post failure Rita Ruvinsky
2026-08-06 0:31 ` [EXTERNAL] " Long Li
2026-08-06 0:29 ` [EXTERNAL] [PATCH 1/2] net/mana: fix MR length truncation for chunks over 4GB Long Li
2026-08-06 17:02 ` Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260805154407.1965063-1-rita.ruvinsky@weka.io \
--to=rita.ruvinsky@weka.io \
--cc=dev@dpdk.org \
--cc=longli@microsoft.com \
--cc=stable@dpdk.org \
--cc=weh@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox