patch 'net/mlx5: fix crash on counter pool destroy' has been queued to stable release 22.11.6

[luca.boccassi@gmail.com]

Hi,

FYI, your patch has been queued to stable release 22.11.6

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 06/27/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/e12b4a47badb24b5b69c60fad22653aee3ee8869

Thanks.

Luca Boccassi

---
From e12b4a47badb24b5b69c60fad22653aee3ee8869 Mon Sep 17 00:00:00 2001
From: Maayan Kashani <mkashani@nvidia.com>
Date: Sun, 9 Jun 2024 14:01:02 +0300
Subject: [PATCH] net/mlx5: fix crash on counter pool destroy

[ upstream commit 3331d59551cdecd2db3a2064a7d6e4bf9396b849 ]

If the counter pool was not added to list,
and an error state was reached,
on attempt to destroy the counter pool,
segmentation fault was received during list remove action.

Added a check to verify the list is not empty before trying to
remove the cpool from the list.

Invalid state, leading to segfault,
can also be reached in the following scenario:
1.	mlx5_hws_cnt_pool_init() does a zmalloc and initializes most
        of the fields of cpool, but does not initialize the next field.
2.	mlx5_hws_cnt_pool_dcs_alloc() attempts to bulk allocate flow counters.
	If this fails, we skip straight to 4.
	In HW, this can fail simply if FW doesn't support bulk flow
	counter allocation.
3.	Right before the goto error, we insert the cpool to the hws_cpool_list.
	This is where the next field is initialized.
4.	mlx5_hws_cnt_pool_destroy() assumes the cpool's next field
	is initialized and SEGVs if not.

So, added a guard against cases where the entry was uninitialized
(checking le_prev field is not NULL).

Fixes: 6ac2104ac125 ("net/mlx5: fix counter query during port close")

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_hws_cnt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_hws_cnt.c b/drivers/net/mlx5/mlx5_hws_cnt.c
index d4ef44d1a3..8415aa411f 100644
--- a/drivers/net/mlx5/mlx5_hws_cnt.c
+++ b/drivers/net/mlx5/mlx5_hws_cnt.c
@@ -717,7 +717,9 @@ mlx5_hws_cnt_pool_destroy(struct mlx5_dev_ctx_shared *sh,
 	 * Maybe blocked for at most 200ms here.
 	 */
 	rte_spinlock_lock(&sh->cpool_lock);
-	LIST_REMOVE(cpool, next);
+	/* Try to remove cpool before it was added to list caused segfault. */
+	if (!LIST_EMPTY(&sh->hws_cpool_list) && cpool->next.le_prev)
+		LIST_REMOVE(cpool, next);
 	rte_spinlock_unlock(&sh->cpool_lock);
 	if (--sh->cnt_svc->refcnt == 0)
 		mlx5_hws_cnt_svc_deinit(sh);
-- 
2.39.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-06-25 00:22:17.493745565 +0100
+++ 0077-net-mlx5-fix-crash-on-counter-pool-destroy.patch	2024-06-25 00:22:13.297187932 +0100
@@ -1 +1 @@
-From 3331d59551cdecd2db3a2064a7d6e4bf9396b849 Mon Sep 17 00:00:00 2001
+From e12b4a47badb24b5b69c60fad22653aee3ee8869 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3331d59551cdecd2db3a2064a7d6e4bf9396b849 ]
+
@@ -31 +32,0 @@
-Cc: stable@dpdk.org
@@ -40 +41 @@
-index 36d422bdfa..a46a4bd94e 100644
+index d4ef44d1a3..8415aa411f 100644
@@ -43 +44 @@
-@@ -718,7 +718,9 @@ mlx5_hws_cnt_pool_destroy(struct mlx5_dev_ctx_shared *sh,
+@@ -717,7 +717,9 @@ mlx5_hws_cnt_pool_destroy(struct mlx5_dev_ctx_shared *sh,
@@ -52,2 +53,2 @@
- 	if (cpool->cfg.host_cpool == NULL) {
- 		if (--sh->cnt_svc->refcnt == 0)
+ 	if (--sh->cnt_svc->refcnt == 0)
+ 		mlx5_hws_cnt_svc_deinit(sh);