patch 'baseband/acc: fix access to deallocated mem' has been queued to stable release 22.11.7

[luca.boccassi@gmail.com]

Hi,

FYI, your patch has been queued to stable release 22.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/25/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/e8d41d4db2561550810000b00b6c6775907833c3

Thanks.

Luca Boccassi

---
From e8d41d4db2561550810000b00b6c6775907833c3 Mon Sep 17 00:00:00 2001
From: Hernan Vargas <hernan.vargas@intel.com>
Date: Wed, 9 Oct 2024 14:12:51 -0700
Subject: [PATCH] baseband/acc: fix access to deallocated mem

[ upstream commit a090b8ffe73ed21d54e17e5d5711d2e817d7229e ]

Prevent op_addr access during queue_stop operation, as this memory may
have been deallocated.

Fixes: e640f6cdfa84 ("baseband/acc200: add LDPC processing")

Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
---
 drivers/baseband/acc/rte_acc100_pmd.c | 36 --------------------------
 drivers/baseband/acc/rte_acc200_pmd.c | 37 +--------------------------
 2 files changed, 1 insertion(+), 72 deletions(-)

diff --git a/drivers/baseband/acc/rte_acc100_pmd.c b/drivers/baseband/acc/rte_acc100_pmd.c
index 955c0236e4..a5b1bb66eb 100644
--- a/drivers/baseband/acc/rte_acc100_pmd.c
+++ b/drivers/baseband/acc/rte_acc100_pmd.c
@@ -837,51 +837,15 @@ free_q:
 	return ret;
 }
 
-static inline void
-acc100_print_op(struct rte_bbdev_dec_op *op, enum rte_bbdev_op_type op_type,
-		uint16_t index)
-{
-	if (op == NULL)
-		return;
-	if (op_type == RTE_BBDEV_OP_LDPC_DEC)
-		rte_bbdev_log(DEBUG,
-			"  Op 5GUL %d %d %d %d %d %d %d %d %d %d %d %d",
-			index,
-			op->ldpc_dec.basegraph, op->ldpc_dec.z_c,
-			op->ldpc_dec.n_cb, op->ldpc_dec.q_m,
-			op->ldpc_dec.n_filler, op->ldpc_dec.cb_params.e,
-			op->ldpc_dec.op_flags, op->ldpc_dec.rv_index,
-			op->ldpc_dec.iter_max, op->ldpc_dec.iter_count,
-			op->ldpc_dec.harq_combined_input.length
-			);
-	else if (op_type == RTE_BBDEV_OP_LDPC_ENC) {
-		struct rte_bbdev_enc_op *op_dl = (struct rte_bbdev_enc_op *) op;
-		rte_bbdev_log(DEBUG,
-			"  Op 5GDL %d %d %d %d %d %d %d %d %d",
-			index,
-			op_dl->ldpc_enc.basegraph, op_dl->ldpc_enc.z_c,
-			op_dl->ldpc_enc.n_cb, op_dl->ldpc_enc.q_m,
-			op_dl->ldpc_enc.n_filler, op_dl->ldpc_enc.cb_params.e,
-			op_dl->ldpc_enc.op_flags, op_dl->ldpc_enc.rv_index
-			);
-	}
-}
-
 static int
 acc100_queue_stop(struct rte_bbdev *dev, uint16_t queue_id)
 {
 	struct acc_queue *q;
-	struct rte_bbdev_dec_op *op;
-	uint16_t i;
 
 	q = dev->data->queues[queue_id].queue_private;
 	rte_bbdev_log(INFO, "Queue Stop %d H/T/D %d %d %x OpType %d",
 			queue_id, q->sw_ring_head, q->sw_ring_tail,
 			q->sw_ring_depth, q->op_type);
-	for (i = 0; i < q->sw_ring_depth; ++i) {
-		op = (q->ring_addr + i)->req.op_addr;
-		acc100_print_op(op, q->op_type, i);
-	}
 	/* ignore all operations in flight and clear counters */
 	q->sw_ring_tail = q->sw_ring_head;
 	q->aq_enqueued = 0;
diff --git a/drivers/baseband/acc/rte_acc200_pmd.c b/drivers/baseband/acc/rte_acc200_pmd.c
index 8bda3a8e07..f2b7172e71 100644
--- a/drivers/baseband/acc/rte_acc200_pmd.c
+++ b/drivers/baseband/acc/rte_acc200_pmd.c
@@ -924,51 +924,16 @@ free_q:
 	return ret;
 }
 
-static inline void
-acc200_print_op(struct rte_bbdev_dec_op *op, enum rte_bbdev_op_type op_type,
-		uint16_t index)
-{
-	if (op == NULL)
-		return;
-	if (op_type == RTE_BBDEV_OP_LDPC_DEC)
-		rte_bbdev_log(INFO,
-			"  Op 5GUL %d %d %d %d %d %d %d %d %d %d %d %d",
-			index,
-			op->ldpc_dec.basegraph, op->ldpc_dec.z_c,
-			op->ldpc_dec.n_cb, op->ldpc_dec.q_m,
-			op->ldpc_dec.n_filler, op->ldpc_dec.cb_params.e,
-			op->ldpc_dec.op_flags, op->ldpc_dec.rv_index,
-			op->ldpc_dec.iter_max, op->ldpc_dec.iter_count,
-			op->ldpc_dec.harq_combined_input.length
-			);
-	else if (op_type == RTE_BBDEV_OP_LDPC_ENC) {
-		struct rte_bbdev_enc_op *op_dl = (struct rte_bbdev_enc_op *) op;
-		rte_bbdev_log(INFO,
-			"  Op 5GDL %d %d %d %d %d %d %d %d %d",
-			index,
-			op_dl->ldpc_enc.basegraph, op_dl->ldpc_enc.z_c,
-			op_dl->ldpc_enc.n_cb, op_dl->ldpc_enc.q_m,
-			op_dl->ldpc_enc.n_filler, op_dl->ldpc_enc.cb_params.e,
-			op_dl->ldpc_enc.op_flags, op_dl->ldpc_enc.rv_index
-			);
-	}
-}
-
 /* Stop ACC200 queue and clear counters. */
 static int
 acc200_queue_stop(struct rte_bbdev *dev, uint16_t queue_id)
 {
 	struct acc_queue *q;
-	struct rte_bbdev_dec_op *op;
-	uint16_t i;
+
 	q = dev->data->queues[queue_id].queue_private;
 	rte_bbdev_log(INFO, "Queue Stop %d H/T/D %d %d %x OpType %d",
 			queue_id, q->sw_ring_head, q->sw_ring_tail,
 			q->sw_ring_depth, q->op_type);
-	for (i = 0; i < q->sw_ring_depth; ++i) {
-		op = (q->ring_addr + i)->req.op_addr;
-		acc200_print_op(op, q->op_type, i);
-	}
 	/* ignore all operations in flight and clear counters */
 	q->sw_ring_tail = q->sw_ring_head;
 	q->aq_enqueued = 0;
-- 
2.45.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-10-23 22:16:41.588552062 +0100
+++ 0028-baseband-acc-fix-access-to-deallocated-mem.patch	2024-10-23 22:16:40.463941341 +0100
@@ -1 +1 @@
-From a090b8ffe73ed21d54e17e5d5711d2e817d7229e Mon Sep 17 00:00:00 2001
+From e8d41d4db2561550810000b00b6c6775907833c3 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit a090b8ffe73ed21d54e17e5d5711d2e817d7229e ]
+
@@ -10 +11,0 @@
-Cc: stable@dpdk.org
@@ -15,3 +16,3 @@
- drivers/baseband/acc/rte_acc100_pmd.c | 36 ----------------------
- drivers/baseband/acc/rte_vrb_pmd.c    | 44 +--------------------------
- 2 files changed, 1 insertion(+), 79 deletions(-)
+ drivers/baseband/acc/rte_acc100_pmd.c | 36 --------------------------
+ drivers/baseband/acc/rte_acc200_pmd.c | 37 +--------------------------
+ 2 files changed, 1 insertion(+), 72 deletions(-)
@@ -20 +21 @@
-index 5e6ee85e13..c690d1492b 100644
+index 955c0236e4..a5b1bb66eb 100644
@@ -23 +24 @@
-@@ -838,51 +838,15 @@ free_q:
+@@ -837,51 +837,15 @@ free_q:
@@ -75,5 +76,5 @@
-diff --git a/drivers/baseband/acc/rte_vrb_pmd.c b/drivers/baseband/acc/rte_vrb_pmd.c
-index 646c12ad5c..e3f98d6e42 100644
---- a/drivers/baseband/acc/rte_vrb_pmd.c
-+++ b/drivers/baseband/acc/rte_vrb_pmd.c
-@@ -1048,58 +1048,16 @@ free_q:
+diff --git a/drivers/baseband/acc/rte_acc200_pmd.c b/drivers/baseband/acc/rte_acc200_pmd.c
+index 8bda3a8e07..f2b7172e71 100644
+--- a/drivers/baseband/acc/rte_acc200_pmd.c
++++ b/drivers/baseband/acc/rte_acc200_pmd.c
+@@ -924,51 +924,16 @@ free_q:
@@ -84 +85 @@
--vrb_print_op(struct rte_bbdev_dec_op *op, enum rte_bbdev_op_type op_type,
+-acc200_print_op(struct rte_bbdev_dec_op *op, enum rte_bbdev_op_type op_type,
@@ -110,7 +110,0 @@
--	} else if (op_type == RTE_BBDEV_OP_MLDTS) {
--		struct rte_bbdev_mldts_op *op_mldts = (struct rte_bbdev_mldts_op *) op;
--		rte_bbdev_log(INFO, "  Op MLD %d RBs %d NL %d Rp %d %d %x",
--				index,
--				op_mldts->mldts.num_rbs, op_mldts->mldts.num_layers,
--				op_mldts->mldts.r_rep,
--				op_mldts->mldts.c_rep, op_mldts->mldts.op_flags);
@@ -120 +114 @@
- /* Stop queue and clear counters. */
+ /* Stop ACC200 queue and clear counters. */
@@ -122 +116 @@
- vrb_queue_stop(struct rte_bbdev *dev, uint16_t queue_id)
+ acc200_queue_stop(struct rte_bbdev *dev, uint16_t queue_id)
@@ -134 +128 @@
--		vrb_print_op(op, q->op_type, i);
+-		acc200_print_op(op, q->op_type, i);