[PATCH] net/ixgbe: fix flow control frame byte adjustment

[PATCH] net/ixgbe: fix flow control frame byte adjustment

[Daniil Iskhakov]

LXONTXC and LXOFFTXC are 32-bit counters for transmitted XON and
XOFF packets. ixgbe_read_stats_registers() sums their deltas and uses
the result to adjust the transmitted byte counters by the minimum
Ethernet frame length.

The sum is currently computed as:

	total = lxon + lxoff

Since both operands are 32-bit, the addition is performed in 32 bits
and may wrap before the result is stored in total. The wrapped value is
then used in the byte adjustment, which may make the software byte
counters incorrect.

Make total 64-bit and cast lxon before the addition so the XON/XOFF
packet sum and the following byte adjustment are computed without
32-bit overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Daniil Iskhakov <dish@amicon.ru>
---
Cc: sdl.dpdk@linuxtesting.org
Cc: rrv@amicon.ru
---
 drivers/net/intel/ixgbe/ixgbe_ethdev.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/intel/ixgbe/ixgbe_ethdev.c b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
index 57d929cf2c..cff2dbd900 100644
--- a/drivers/net/intel/ixgbe/ixgbe_ethdev.c
+++ b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
@@ -3181,7 +3181,8 @@ ixgbe_read_stats_registers(struct ixgbe_hw *hw,
 			   uint64_t *total_missed_rx, uint64_t *total_qbrc,
 			   uint64_t *total_qprc, uint64_t *total_qprdc)
 {
-	uint32_t bprc, lxon, lxoff, total;
+	uint32_t bprc, lxon, lxoff;
+	uint64_t total;
 	uint32_t delta_gprc = 0;
 	unsigned i;
 	/* Workaround for RX byte count not including CRC bytes when CRC
@@ -3310,7 +3311,7 @@ ixgbe_read_stats_registers(struct ixgbe_hw *hw,
 	hw_stats->lxontxc += lxon;
 	lxoff = IXGBE_READ_REG(hw, IXGBE_LXOFFTXC);
 	hw_stats->lxofftxc += lxoff;
-	total = lxon + lxoff;
+	total = (uint64_t)lxon + lxoff;
 
 	hw_stats->mptc += IXGBE_READ_REG(hw, IXGBE_MPTC);
 	hw_stats->ptc64 += IXGBE_READ_REG(hw, IXGBE_PTC64);
-- 
2.43.0

Re: [PATCH] net/ixgbe: fix flow control frame byte adjustment

[Bruce Richardson]

On Mon, May 04, 2026 at 05:55:02PM +0300, Daniil Iskhakov wrote:
> LXONTXC and LXOFFTXC are 32-bit counters for transmitted XON and
> XOFF packets. ixgbe_read_stats_registers() sums their deltas and uses
> the result to adjust the transmitted byte counters by the minimum
> Ethernet frame length.
> 
> The sum is currently computed as:
> 
> 	total = lxon + lxoff
> 
> Since both operands are 32-bit, the addition is performed in 32 bits
> and may wrap before the result is stored in total. The wrapped value is
> then used in the byte adjustment, which may make the software byte
> counters incorrect.
> 
> Make total 64-bit and cast lxon before the addition so the XON/XOFF
> packet sum and the following byte adjustment are computed without
> 32-bit overflow.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: af75078fece3 ("first public release")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Daniil Iskhakov <dish@amicon.ru>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Re: [PATCH] net/ixgbe: fix flow control frame byte adjustment

[Bruce Richardson]

On Tue, May 19, 2026 at 03:44:41PM +0100, Bruce Richardson wrote:
> On Mon, May 04, 2026 at 05:55:02PM +0300, Daniil Iskhakov wrote:
> > LXONTXC and LXOFFTXC are 32-bit counters for transmitted XON and
> > XOFF packets. ixgbe_read_stats_registers() sums their deltas and uses
> > the result to adjust the transmitted byte counters by the minimum
> > Ethernet frame length.
> > 
> > The sum is currently computed as:
> > 
> > 	total = lxon + lxoff
> > 
> > Since both operands are 32-bit, the addition is performed in 32 bits
> > and may wrap before the result is stored in total. The wrapped value is
> > then used in the byte adjustment, which may make the software byte
> > counters incorrect.
> > 
> > Make total 64-bit and cast lxon before the addition so the XON/XOFF
> > packet sum and the following byte adjustment are computed without
> > 32-bit overflow.
> > 
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> > 
> > Fixes: af75078fece3 ("first public release")
> > Cc: stable@dpdk.org
> > 
> > Signed-off-by: Daniil Iskhakov <dish@amicon.ru>
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> 

Applied to dpdk-next-net-intel.
Thanks,
/Bruce