patch 'net/i40e/base: fix loop bounds' has been queued to stable release 22.11.7

[luca.boccassi@gmail.com]

Hi,

FYI, your patch has been queued to stable release 22.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/25/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/6c69f14358ba4ae6412cbf2c5eb73dfe9ccfa09b

Thanks.

Luca Boccassi

---
From 6c69f14358ba4ae6412cbf2c5eb73dfe9ccfa09b Mon Sep 17 00:00:00 2001
From: Barbara Skobiej <barbara.skobiej@intel.com>
Date: Mon, 2 Sep 2024 10:54:35 +0100
Subject: [PATCH] net/i40e/base: fix loop bounds

[ upstream commit 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 ]

An unchecked value used as a loop bound. Add verification if value of
'next_to_clean' variable is greater than 2^10 (next_to_clean is 10 bits).

Also, refactored loop so that it reads the head value only once, and also
checks if head is invalid.

Fixes: 8db9e2a1b232 ("i40e: base driver")

Signed-off-by: Barbara Skobiej <barbara.skobiej@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
---
 drivers/net/i40e/base/i40e_adminq.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/net/i40e/base/i40e_adminq.c b/drivers/net/i40e/base/i40e_adminq.c
index 27c82d9b44..cd3b0f2e45 100644
--- a/drivers/net/i40e/base/i40e_adminq.c
+++ b/drivers/net/i40e/base/i40e_adminq.c
@@ -791,12 +791,26 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
 	u16 ntc = asq->next_to_clean;
 	struct i40e_aq_desc desc_cb;
 	struct i40e_aq_desc *desc;
+	u32 head = 0;
+
+	if (ntc >= (1 << 10))
+		goto clean_asq_exit;
 
 	desc = I40E_ADMINQ_DESC(*asq, ntc);
 	details = I40E_ADMINQ_DETAILS(*asq, ntc);
-	while (rd32(hw, hw->aq.asq.head) != ntc) {
+	while (true) {
+		head = rd32(hw, hw->aq.asq.head);
+
+		if (head >= asq->count) {
+			i40e_debug(hw, I40E_DEBUG_AQ_COMMAND, "Read head value is improper\n");
+			return 0;
+		}
+
+		if (head == ntc)
+			break;
+
 		i40e_debug(hw, I40E_DEBUG_AQ_COMMAND,
-			   "ntc %d head %d.\n", ntc, rd32(hw, hw->aq.asq.head));
+			   "ntc %d head %d.\n", ntc, head);
 
 		if (details->callback) {
 			I40E_ADMINQ_CALLBACK cb_func =
@@ -816,6 +830,7 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
 
 	asq->next_to_clean = ntc;
 
+clean_asq_exit:
 	return I40E_DESC_UNUSED(asq);
 }
 
-- 
2.45.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-10-23 22:16:42.189323744 +0100
+++ 0044-net-i40e-base-fix-loop-bounds.patch	2024-10-23 22:16:40.495942585 +0100
@@ -1 +1 @@
-From 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 Mon Sep 17 00:00:00 2001
+From 6c69f14358ba4ae6412cbf2c5eb73dfe9ccfa09b Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 ]
+
@@ -13 +14,0 @@
-Cc: stable@dpdk.org
@@ -23 +24 @@
-index b670250180..350288269b 100644
+index 27c82d9b44..cd3b0f2e45 100644
@@ -26 +27 @@
-@@ -745,12 +745,26 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
+@@ -791,12 +791,26 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
@@ -55 +56 @@
-@@ -770,6 +784,7 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
+@@ -816,6 +830,7 @@ u16 i40e_clean_asq(struct i40e_hw *hw)