patch 'ethdev: fix overflow in descriptor count' has been queued to stable release 22.11.7

[luca.boccassi@gmail.com]

Hi,

FYI, your patch has been queued to stable release 22.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/25/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/a905d9d63ec9bb6540978f1906c3d7f591c78586

Thanks.

Luca Boccassi

---
From a905d9d63ec9bb6540978f1906c3d7f591c78586 Mon Sep 17 00:00:00 2001
From: Niall Meade <niall.meade@intel.com>
Date: Mon, 30 Sep 2024 13:40:02 +0000
Subject: [PATCH] ethdev: fix overflow in descriptor count

[ upstream commit 30efe60d3a37896567b660229ef6a04c5526f6db ]

Addressed a specific overflow issue in the eth_dev_adjust_nb_desc()
function where the uint16_t variable nb_desc would overflow when its
value was greater than (2^16 - nb_align). This overflow caused nb_desc
to incorrectly wrap around between 0 and nb_align-1, leading to the
function setting nb_desc to nb_min instead of the expected nb_max.

To give an example, let nb_desc=UINT16_MAX, nb_align=32, nb_max=4096 and
nb_min=64. RTE_ALIGN_CEIL(nb_desc, nb_align) calls
RTE_ALIGN_FLOOR(nb_desc + nb_align - 1, nb_align). This results in an
overflow of nb_desc, leading to nb_desc being set to 30 and then 0 when
the macros return. As a result of this, nb_desc is then set to nb_min
later on.

The resolution involves upcasting nb_desc to a uint32_t before the
RTE_ALIGN_CEIL macro is applied. This change ensures that the subsequent
call to RTE_ALIGN_FLOOR(nb_desc + (nb_align - 1), nb_align) does not
result in an overflow, as it would when nb_desc is a uint16_t. By using
a uint32_t for these operations, the correct behavior is maintained
without the risk of overflow.

Fixes: 0f67fc3baeb9 ("ethdev: add function to adjust number of descriptors")

Signed-off-by: Niall Meade <niall.meade@intel.com>
Reviewed-by: Ferruh Yigit <ferruh.yigit@amd.com>
---
 .mailmap                |  1 +
 lib/ethdev/rte_ethdev.c | 12 +++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.mailmap b/.mailmap
index 8c7b38fb35..dd1c6a6a87 100644
--- a/.mailmap
+++ b/.mailmap
@@ -989,6 +989,7 @@ Nelson Escobar <neescoba@cisco.com>
 Nemanja Marjanovic <nemanja.marjanovic@intel.com>
 Netanel Belgazal <netanel@amazon.com>
 Netanel Gonen <netanelg@mellanox.com>
+Niall Meade <niall.meade@intel.com>
 Niall Power <niall.power@intel.com>
 Nick Connolly <nick.connolly@arm.com> <nick.connolly@mayadata.io>
 Nick Nunley <nicholas.d.nunley@intel.com>
diff --git a/lib/ethdev/rte_ethdev.c b/lib/ethdev/rte_ethdev.c
index e1f18fd8a4..e85dc3d8b2 100644
--- a/lib/ethdev/rte_ethdev.c
+++ b/lib/ethdev/rte_ethdev.c
@@ -5739,13 +5739,19 @@ static void
 eth_dev_adjust_nb_desc(uint16_t *nb_desc,
 		const struct rte_eth_desc_lim *desc_lim)
 {
+	/* Upcast to uint32 to avoid potential overflow with RTE_ALIGN_CEIL(). */
+	uint32_t nb_desc_32 = (uint32_t)*nb_desc;
+
 	if (desc_lim->nb_align != 0)
-		*nb_desc = RTE_ALIGN_CEIL(*nb_desc, desc_lim->nb_align);
+		nb_desc_32 = RTE_ALIGN_CEIL(nb_desc_32, desc_lim->nb_align);
 
 	if (desc_lim->nb_max != 0)
-		*nb_desc = RTE_MIN(*nb_desc, desc_lim->nb_max);
+		nb_desc_32 = RTE_MIN(nb_desc_32, desc_lim->nb_max);
 
-	*nb_desc = RTE_MAX(*nb_desc, desc_lim->nb_min);
+	nb_desc_32 = RTE_MAX(nb_desc_32, desc_lim->nb_min);
+
+	/* Assign clipped u32 back to u16. */
+	*nb_desc = (uint16_t)nb_desc_32;
 }
 
 int
-- 
2.45.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-10-23 22:16:42.606290111 +0100
+++ 0055-ethdev-fix-overflow-in-descriptor-count.patch	2024-10-23 22:16:40.515943363 +0100
@@ -1 +1 @@
-From 30efe60d3a37896567b660229ef6a04c5526f6db Mon Sep 17 00:00:00 2001
+From a905d9d63ec9bb6540978f1906c3d7f591c78586 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 30efe60d3a37896567b660229ef6a04c5526f6db ]
+
@@ -27 +28,0 @@
-Cc: stable@dpdk.org
@@ -37 +38 @@
-index d49838320e..6e72362ebc 100644
+index 8c7b38fb35..dd1c6a6a87 100644
@@ -40 +41 @@
-@@ -1070,6 +1070,7 @@ Nelson Escobar <neescoba@cisco.com>
+@@ -989,6 +989,7 @@ Nelson Escobar <neescoba@cisco.com>
@@ -46 +46,0 @@
- Nicholas Pratte <npratte@iol.unh.edu>
@@ -47,0 +48 @@
+ Nick Nunley <nicholas.d.nunley@intel.com>
@@ -49 +50 @@
-index a1f7efa913..84ee7588fc 100644
+index e1f18fd8a4..e85dc3d8b2 100644
@@ -52 +53 @@
-@@ -6667,13 +6667,19 @@ static void
+@@ -5739,13 +5739,19 @@ static void