From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 4A2F3A0542; Mon, 29 Aug 2022 17:14:59 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 369C840DF7; Mon, 29 Aug 2022 17:14:59 +0200 (CEST) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) by mails.dpdk.org (Postfix) with ESMTP id 985F24003C; Mon, 29 Aug 2022 17:14:57 +0200 (CEST) Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 3854A5C01A4; Mon, 29 Aug 2022 11:14:57 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute2.internal (MEProxy); Mon, 29 Aug 2022 11:14:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=monjalon.net; h= cc:cc:content-transfer-encoding:date:date:from:from:in-reply-to :message-id:mime-version:reply-to:sender:subject:subject:to:to; s=fm1; t=1661786097; x=1661872497; bh=CZM4V5RlEED4kHvkwOZvQPjOn vm2RppJ9zwSWFpJBuY=; b=Hs/eQVvj1FyQckumK8rB/vfU3XDXqr1wFte4C08T8 qdnvMIVkpTnzqIHtJsMO9+6h2/iAxmYiycn0JSVk4tQr5/XL0j9CBfDCg4lUZhWP G0kjDR/Sb/2LKtrDR7Vzpft8wPiB+RBgrpuu0osa499zLY5XeaIMWDQfhul8HkEW kE8xvgueoXN3QexukleFvMgOuocNqoyfPnm84Y6rENmtrRL3XJUzs+r4OMUHc//g NkOC4IUZF7iVk4zgOAIDUIdwyBHcwIiyE5zOKhdHaDDeAHT+4RQmAsz4pvx7dyJe G/GDqroU3vaWbulUO1dtqaQSOgGTfZhvrNqLqdJcmFIyA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding:date:date :feedback-id:feedback-id:from:from:in-reply-to:message-id :mime-version:reply-to:sender:subject:subject:to:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t= 1661786097; x=1661872497; bh=CZM4V5RlEED4kHvkwOZvQPjOnvm2RppJ9zw SWFpJBuY=; b=Oz2o5GuuW5cxMIDXbR0/VKNxvXHrwjBmGbmP0+/Y81I8ERQjPWV RFq1iH5sdaeU9xfTRinXrKo6kG4ytamkazWN61QSBRAnnDESYxHARlN/xvLgoWqa 63W8++YD/Q19Esf/02rxrD64I57p3viSNkHYnloXLelXDfMdphyuHK3Y3tSI8L5x W0duBqnRaYmyOxcdE8sq7FKoZUoXxKj0UNkIhGYPaKwpLjaqQRvmzvIhltwc+IlF kAGeItT93svu43knID9FELIfVWSmNkr06U69fzJ97UxbPhdC1HwOpdAwDpknwRhE vrvGO7y2UfzaZDZbcm+WzmmLGClzDEnv7Vg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvfedrvdekuddgkeekucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhephffvvefufffkofgggfestdekredtredttdenucfhrhhomhepvfhhohhmrghs ucfoohhnjhgrlhhonhcuoehthhhomhgrshesmhhonhhjrghlohhnrdhnvghtqeenucggtf frrghtthgvrhhnpeevveefveeiiefhtedukeegkeelieegffeukeevudetueffieduveet iedukeefleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhroh hmpehthhhomhgrshesmhhonhhjrghlohhnrdhnvght X-ME-Proxy: Feedback-ID: i47234305:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 29 Aug 2022 11:14:55 -0400 (EDT) From: Thomas Monjalon To: dev@dpdk.org Cc: security@dpdk.org, Matan Azrad , stable@dpdk.org, Alexander Kozyrev , Viacheslav Ovsiienko , Shahaf Shuler Subject: [PATCH] net/mlx5: fix Rx queue recovery mechanism Date: Mon, 29 Aug 2022 17:14:36 +0200 Message-Id: <20220829151436.1909142-1-thomas@monjalon.net> X-Mailer: git-send-email 2.36.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Matan Azrad The local variables are getting inconsistent in data receiving routines after queue error recovery. Receive queue consumer index is getting wrong, need to reset one to the size of the queue (as RQ was fully replenished in recovery procedure). In MPRQ case, also the local consumed strd variable should be reset. CVE-2022-28199 Fixes: 88c0733535d6 ("net/mlx5: extend Rx completion with error handling") Cc: stable@dpdk.org Signed-off-by: Alexander Kozyrev Signed-off-by: Matan Azrad --- Already applied in main branch as part of the public disclosure process. --- drivers/net/mlx5/mlx5_rx.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rx.c b/drivers/net/mlx5/mlx5_rx.c index bb3ccc36e5..917c517b83 100644 --- a/drivers/net/mlx5/mlx5_rx.c +++ b/drivers/net/mlx5/mlx5_rx.c @@ -408,6 +408,11 @@ mlx5_rxq_initialize(struct mlx5_rxq_data *rxq) *rxq->rq_db = rte_cpu_to_be_32(rxq->rq_ci); } +/* Must be negative. */ +#define MLX5_ERROR_CQE_RET (-1) +/* Must not be negative. */ +#define MLX5_RECOVERY_ERROR_RET 0 + /** * Handle a Rx error. * The function inserts the RQ state to reset when the first error CQE is @@ -422,7 +427,7 @@ mlx5_rxq_initialize(struct mlx5_rxq_data *rxq) * 0 when called from non-vectorized Rx burst. * * @return - * -1 in case of recovery error, otherwise the CQE status. + * MLX5_RECOVERY_ERROR_RET in case of recovery error, otherwise the CQE status. */ int mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec) @@ -451,7 +456,7 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec) sm.queue_id = rxq->idx; sm.state = IBV_WQS_RESET; if (mlx5_queue_state_modify(RXQ_DEV(rxq_ctrl), &sm)) - return -1; + return MLX5_RECOVERY_ERROR_RET; if (rxq_ctrl->dump_file_n < RXQ_PORT(rxq_ctrl)->config.max_dump_files_num) { MKSTR(err_str, "Unexpected CQE error syndrome " @@ -491,7 +496,7 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec) sm.queue_id = rxq->idx; sm.state = IBV_WQS_RDY; if (mlx5_queue_state_modify(RXQ_DEV(rxq_ctrl), &sm)) - return -1; + return MLX5_RECOVERY_ERROR_RET; if (vec) { const uint32_t elts_n = mlx5_rxq_mprq_enabled(rxq) ? @@ -519,7 +524,7 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec) rte_pktmbuf_free_seg (*elt); } - return -1; + return MLX5_RECOVERY_ERROR_RET; } } for (i = 0; i < (int)elts_n; ++i) { @@ -538,7 +543,7 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec) } return ret; default: - return -1; + return MLX5_RECOVERY_ERROR_RET; } } @@ -556,7 +561,9 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec) * written. * * @return - * 0 in case of empty CQE, otherwise the packet size in bytes. + * 0 in case of empty CQE, MLX5_ERROR_CQE_RET in case of error CQE, + * otherwise the packet size in regular RxQ, and striding byte + * count format in mprq case. */ static inline int mlx5_rx_poll_len(struct mlx5_rxq_data *rxq, volatile struct mlx5_cqe *cqe, @@ -623,8 +630,8 @@ mlx5_rx_poll_len(struct mlx5_rxq_data *rxq, volatile struct mlx5_cqe *cqe, rxq->err_state)) { ret = mlx5_rx_err_handle(rxq, 0); if (ret == MLX5_CQE_STATUS_HW_OWN || - ret == -1) - return 0; + ret == MLX5_RECOVERY_ERROR_RET) + return MLX5_ERROR_CQE_RET; } else { return 0; } @@ -869,8 +876,10 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n) if (!pkt) { cqe = &(*rxq->cqes)[rxq->cq_ci & cqe_cnt]; len = mlx5_rx_poll_len(rxq, cqe, cqe_cnt, &mcqe); - if (!len) { + if (len <= 0) { rte_mbuf_raw_free(rep); + if (unlikely(len == MLX5_ERROR_CQE_RET)) + rq_ci = rxq->rq_ci << sges_n; break; } pkt = seg; @@ -1093,8 +1102,13 @@ mlx5_rx_burst_mprq(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n) } cqe = &(*rxq->cqes)[rxq->cq_ci & cq_mask]; ret = mlx5_rx_poll_len(rxq, cqe, cq_mask, &mcqe); - if (!ret) + if (ret == 0) break; + if (unlikely(ret == MLX5_ERROR_CQE_RET)) { + rq_ci = rxq->rq_ci; + consumed_strd = rxq->consumed_strd; + break; + } byte_cnt = ret; len = (byte_cnt & MLX5_MPRQ_LEN_MASK) >> MLX5_MPRQ_LEN_SHIFT; MLX5_ASSERT((int)len >= (rxq->crc_present << 2)); -- 2.36.1