ixgbe: fix header len when unsplit packet overflows to data buffer

When in packet split mode, packet type is not recognized, and the packet is
larger than the header size, the 82599 overflows the packet into the data
area, but doesn't set the HDR_LEN field.  We can safely assume the length
is the current header size.  This fixes an obscure corner case that can be
triggered by non-ip packet headers or (more likely) by disabling the L2
packet recognition.

Signed-off-by: Shannon Nelson <shannon.nelson@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 926ad8c2f2c73cb238aff8cefe23f52b195a8af5..a9e091cb54991b95c43c2632d527b763869540ff 100644 (file)
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1201,9 +1201,10 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        hdr_info = le16_to_cpu(ixgbe_get_hdr_info(rx_desc));
                        len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
                               IXGBE_RXDADV_HDRBUFLEN_SHIFT;
-                       if (len > IXGBE_RX_HDR_SIZE)
-                               len = IXGBE_RX_HDR_SIZE;
                        upper_len = le16_to_cpu(rx_desc->wb.upper.length);
+                       if ((len > IXGBE_RX_HDR_SIZE) ||
+                           (upper_len && !(hdr_info & IXGBE_RXDADV_SPH)))
+                               len = IXGBE_RX_HDR_SIZE;
                } else {
                        len = le16_to_cpu(rx_desc->wb.upper.length);
                }