ixgbe: fix header len when unsplit packet overflows to data buffer

When in packet split mode, packet type is not recognized, and the packet is
larger than the header size, the 82599 overflows the packet into the data
area, but doesn't set the HDR_LEN field.  We can safely assume the length
is the current header size.  This fixes an obscure corner case that can be
triggered by non-ip packet headers or (more likely) by disabling the L2
packet recognition.

Signed-off-by: Shannon Nelson <shannon.nelson@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 926ad8c..a9e091c 100644 (file)
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1201,9 +1201,10 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        hdr_info = le16_to_cpu(ixgbe_get_hdr_info(rx_desc));
                        len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
                               IXGBE_RXDADV_HDRBUFLEN_SHIFT;
-                       if (len > IXGBE_RX_HDR_SIZE)
-                               len = IXGBE_RX_HDR_SIZE;
                        upper_len = le16_to_cpu(rx_desc->wb.upper.length);
+                       if ((len > IXGBE_RX_HDR_SIZE) ||
+                           (upper_len && !(hdr_info & IXGBE_RXDADV_SPH)))
+                               len = IXGBE_RX_HDR_SIZE;
                } else {
                        len = le16_to_cpu(rx_desc->wb.upper.length);
                }