[PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush

[PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush

[Krzysztof Karas]

Previously it was possible to increment `processed_jobs` to a value
greater than requested `nb_ops`, because after flushing at most
`nb_ops` jobs the while loop continued, so `processed_jobs` could
still be incremented and it was possible for this variable to be
greater than `nb_ops`. If `ops` provided to the function were
only `nb_ops` long, then the `aesni_mb_dequeue_burst()` would
write to the memory outside of `ops` array.

Fixes: b50b8b5b38f8 ("crypto/ipsec_mb: use burst API in AESNI")
Cc: stable@dpdk.org

Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
---

v2:
 * Shortened title to fit in the limit.
 * Changed nb_ops decrementing from 'nb_jobs' to 'i'.

 drivers/crypto/ipsec_mb/pmd_aesni_mb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
index 9e298023d7..aa08490e0c 100644
--- a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
+++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
@@ -2056,7 +2056,7 @@ aesni_mb_dequeue_burst(void *queue_pair, struct rte_crypto_op **ops,
 		uint16_t n = (nb_ops / burst_sz) ?
 			burst_sz : nb_ops;
 
-		while (unlikely((IMB_GET_NEXT_BURST(mb_mgr, n, jobs)) < n)) {
+		if (unlikely((IMB_GET_NEXT_BURST(mb_mgr, n, jobs)) < n)) {
 			/*
 			 * Not enough free jobs in the queue
 			 * Flush n jobs until enough jobs available
@@ -2074,6 +2074,8 @@ aesni_mb_dequeue_burst(void *queue_pair, struct rte_crypto_op **ops,
 					break;
 				}
 			}
+			nb_ops -= i;
+			continue;
 		}
 
 		/*
-- 
2.41.0

---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

RE: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush

[Power, Ciara]

> -----Original Message-----
> From: Karas, Krzysztof <krzysztof.karas@intel.com>
> Sent: Monday, November 13, 2023 8:02 AM
> To: Ji, Kai <kai.ji@intel.com>; De Lara Guarch, Pablo
> <pablo.de.lara.guarch@intel.com>; Cornu, Marcel D
> <marcel.d.cornu@intel.com>; Power, Ciara <ciara.power@intel.com>
> Cc: dev@dpdk.org; Karas, Krzysztof <krzysztof.karas@intel.com>;
> stable@dpdk.org
> Subject: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush
> 
> Previously it was possible to increment `processed_jobs` to a value greater
> than requested `nb_ops`, because after flushing at most `nb_ops` jobs the
> while loop continued, so `processed_jobs` could still be incremented and it
> was possible for this variable to be greater than `nb_ops`. If `ops` provided to
> the function were only `nb_ops` long, then the `aesni_mb_dequeue_burst()`
> would write to the memory outside of `ops` array.
> 
> Fixes: b50b8b5b38f8 ("crypto/ipsec_mb: use burst API in AESNI")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>

Acked-by: Ciara Power <ciara.power@intel.com>

RE: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush

[Cornu, Marcel D]

> -----Original Message-----
> From: Karas, Krzysztof <krzysztof.karas@intel.com>
> Sent: Monday, November 13, 2023 8:02 AM
> To: Ji, Kai <kai.ji@intel.com>; De Lara Guarch, Pablo
> <pablo.de.lara.guarch@intel.com>; Cornu, Marcel D
> <marcel.d.cornu@intel.com>; Power, Ciara <ciara.power@intel.com>
> Cc: dev@dpdk.org; Karas, Krzysztof <krzysztof.karas@intel.com>;
> stable@dpdk.org
> Subject: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush
> 
> Previously it was possible to increment `processed_jobs` to a value greater than
> requested `nb_ops`, because after flushing at most `nb_ops` jobs the while loop
> continued, so `processed_jobs` could still be incremented and it was possible for
> this variable to be greater than `nb_ops`. If `ops` provided to the function were
> only `nb_ops` long, then the `aesni_mb_dequeue_burst()` would write to the
> memory outside of `ops` array.
> 
> Fixes: b50b8b5b38f8 ("crypto/ipsec_mb: use burst API in AESNI")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>

Acked-by: Marcel Cornu <marcel.d.cornu@intel.com>

RE: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush

[De Lara Guarch, Pablo]

> -----Original Message-----
> From: Cornu, Marcel D <marcel.d.cornu@intel.com>
> Sent: Monday, November 13, 2023 11:13 AM
> To: Karas, Krzysztof <krzysztof.karas@intel.com>; Ji, Kai <kai.ji@intel.com>; De
> Lara Guarch, Pablo <pablo.de.lara.guarch@intel.com>; Power, Ciara
> <ciara.power@intel.com>
> Cc: dev@dpdk.org; stable@dpdk.org
> Subject: RE: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush
> 
> 
> > -----Original Message-----
> > From: Karas, Krzysztof <krzysztof.karas@intel.com>
> > Sent: Monday, November 13, 2023 8:02 AM
> > To: Ji, Kai <kai.ji@intel.com>; De Lara Guarch, Pablo
> > <pablo.de.lara.guarch@intel.com>; Cornu, Marcel D
> > <marcel.d.cornu@intel.com>; Power, Ciara <ciara.power@intel.com>
> > Cc: dev@dpdk.org; Karas, Krzysztof <krzysztof.karas@intel.com>;
> > stable@dpdk.org
> > Subject: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush
> >
> > Previously it was possible to increment `processed_jobs` to a value
> > greater than requested `nb_ops`, because after flushing at most
> > `nb_ops` jobs the while loop continued, so `processed_jobs` could
> > still be incremented and it was possible for this variable to be
> > greater than `nb_ops`. If `ops` provided to the function were only
> > `nb_ops` long, then the `aesni_mb_dequeue_burst()` would write to the
> memory outside of `ops` array.
> >
> > Fixes: b50b8b5b38f8 ("crypto/ipsec_mb: use burst API in AESNI")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
> 
> Acked-by: Marcel Cornu <marcel.d.cornu@intel.com>

Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>

RE: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush

[Akhil Goyal]

> > > Subject: [PATCH v2] crypto/ipsec_mb: do not dequeue ops after flush
> > >
> > > Previously it was possible to increment `processed_jobs` to a value
> > > greater than requested `nb_ops`, because after flushing at most
> > > `nb_ops` jobs the while loop continued, so `processed_jobs` could
> > > still be incremented and it was possible for this variable to be
> > > greater than `nb_ops`. If `ops` provided to the function were only
> > > `nb_ops` long, then the `aesni_mb_dequeue_burst()` would write to the
> > memory outside of `ops` array.
> > >
> > > Fixes: b50b8b5b38f8 ("crypto/ipsec_mb: use burst API in AESNI")
> > > Cc: stable@dpdk.org
> > >
> > > Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
> >
> > Acked-by: Marcel Cornu <marcel.d.cornu@intel.com>
> 
> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Applied to dpdk-next-crypto
Thanks.