patch 'net/vmxnet3: fix potential out of bounds stats access' has been queued to stable release 22.11.7

[luca.boccassi@gmail.com]

Hi,

FYI, your patch has been queued to stable release 22.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/14/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/c44cb537e88b037538c132dc742421812c72962c

Thanks.

Luca Boccassi

---
From c44cb537e88b037538c132dc742421812c72962c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Morten=20Br=C3=B8rup?= <mb@smartsharesystems.com>
Date: Mon, 4 Nov 2024 10:52:19 +0000
Subject: [PATCH] net/vmxnet3: fix potential out of bounds stats access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ upstream commit d3a229dd493abcb29d5717c5ce37e0a0bc1777c4 ]

With virtual hardware version 6, the max number of RX queues was
increased to VMXNET3_EXT_MAX_RX_QUEUES (32) from VMXNET3_MAX_RX_QUEUES
(16), similarly, the max number of TX queues was increased to
VMXNET3_EXT_MAX_TX_QUEUES (32) from VMXNET3_MAX_TX_QUEUES (8).  These
increases were not fully considered in the PMD...

The configured number of queues to provide statistics for
(RTE_ETHDEV_QUEUE_STAT_CNTRS) can be smaller than driver's max number of
supported transmit queues for virtual hardware version 6
(VMXNET3_EXT_MAX_RX_QUEUES) (32), which will cause accessing the queue
stats array out of boundary if the application uses more than
RTE_ETHDEV_QUEUE_STAT_CNTRS queues.

This patch fixes this by two modifications
- Increased stats array size to support hardware version 6.
- Respect RTE_ETHDEV_QUEUE_STAT_CNTRS when getting the per-queue
  counters.

The build time check
RTE_BUILD_BUG_ON(RTE_ETHDEV_QUEUE_STAT_CNTRS < VMXNET3_MAX_TX_QUEUES)
has become irrelevant, so it is removed.
With this removal, per-queue stats for fewer queues is supported.

Fixes: b1584dd0affe ("net/vmxnet3: support version 6")

Signed-off-by: Morten Brørup <mb@smartsharesystems.com>
Acked-by: Ferruh Yigit <ferruh.yigit@amd.com>
---
 drivers/net/vmxnet3/vmxnet3_ethdev.c | 32 +++++++++++++++++-----------
 drivers/net/vmxnet3/vmxnet3_ethdev.h |  4 ++--
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c
index 52245c5fbb..5526f7d8fd 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
@@ -1377,42 +1377,52 @@ vmxnet3_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
 	struct vmxnet3_hw *hw = dev->data->dev_private;
 	struct UPT1_TxStats txStats;
 	struct UPT1_RxStats rxStats;
+	uint64_t packets, bytes;
 
 	VMXNET3_WRITE_BAR1_REG(hw, VMXNET3_REG_CMD, VMXNET3_CMD_GET_STATS);
 
 	for (i = 0; i < hw->num_tx_queues; i++) {
 		vmxnet3_tx_stats_get(hw, i, &txStats);
 
-		stats->q_opackets[i] = txStats.ucastPktsTxOK +
+		packets = txStats.ucastPktsTxOK +
 			txStats.mcastPktsTxOK +
 			txStats.bcastPktsTxOK;
 
-		stats->q_obytes[i] = txStats.ucastBytesTxOK +
+		bytes = txStats.ucastBytesTxOK +
 			txStats.mcastBytesTxOK +
 			txStats.bcastBytesTxOK;
 
-		stats->opackets += stats->q_opackets[i];
-		stats->obytes += stats->q_obytes[i];
+		stats->opackets += packets;
+		stats->obytes += bytes;
 		stats->oerrors += txStats.pktsTxError + txStats.pktsTxDiscard;
+
+		if (i < RTE_ETHDEV_QUEUE_STAT_CNTRS) {
+			stats->q_opackets[i] = packets;
+			stats->q_obytes[i] = bytes;
+		}
 	}
 
 	for (i = 0; i < hw->num_rx_queues; i++) {
 		vmxnet3_rx_stats_get(hw, i, &rxStats);
 
-		stats->q_ipackets[i] = rxStats.ucastPktsRxOK +
+		packets = rxStats.ucastPktsRxOK +
 			rxStats.mcastPktsRxOK +
 			rxStats.bcastPktsRxOK;
 
-		stats->q_ibytes[i] = rxStats.ucastBytesRxOK +
+		bytes = rxStats.ucastBytesRxOK +
 			rxStats.mcastBytesRxOK +
 			rxStats.bcastBytesRxOK;
 
-		stats->ipackets += stats->q_ipackets[i];
-		stats->ibytes += stats->q_ibytes[i];
-
-		stats->q_errors[i] = rxStats.pktsRxError;
+		stats->ipackets += packets;
+		stats->ibytes += bytes;
 		stats->ierrors += rxStats.pktsRxError;
 		stats->imissed += rxStats.pktsRxOutOfBuf;
+
+		if (i < RTE_ETHDEV_QUEUE_STAT_CNTRS) {
+			stats->q_ipackets[i] = packets;
+			stats->q_ibytes[i] = bytes;
+			stats->q_errors[i] = rxStats.pktsRxError;
+		}
 	}
 
 	return 0;
@@ -1428,8 +1438,6 @@ vmxnet3_dev_stats_reset(struct rte_eth_dev *dev)
 
 	VMXNET3_WRITE_BAR1_REG(hw, VMXNET3_REG_CMD, VMXNET3_CMD_GET_STATS);
 
-	RTE_BUILD_BUG_ON(RTE_ETHDEV_QUEUE_STAT_CNTRS < VMXNET3_MAX_TX_QUEUES);
-
 	for (i = 0; i < hw->num_tx_queues; i++) {
 		vmxnet3_hw_tx_stats_get(hw, i, &txStats);
 		memcpy(&hw->snapshot_tx_stats[i], &txStats,
diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.h b/drivers/net/vmxnet3/vmxnet3_ethdev.h
index 5a303717b1..ffd21ece79 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethdev.h
+++ b/drivers/net/vmxnet3/vmxnet3_ethdev.h
@@ -120,8 +120,8 @@ struct vmxnet3_hw {
 #define VMXNET3_VFT_TABLE_SIZE     (VMXNET3_VFT_SIZE * sizeof(uint32_t))
 	UPT1_TxStats	      saved_tx_stats[VMXNET3_EXT_MAX_TX_QUEUES];
 	UPT1_RxStats	      saved_rx_stats[VMXNET3_EXT_MAX_RX_QUEUES];
-	UPT1_TxStats          snapshot_tx_stats[VMXNET3_MAX_TX_QUEUES];
-	UPT1_RxStats          snapshot_rx_stats[VMXNET3_MAX_RX_QUEUES];
+	UPT1_TxStats          snapshot_tx_stats[VMXNET3_EXT_MAX_TX_QUEUES];
+	UPT1_RxStats          snapshot_rx_stats[VMXNET3_EXT_MAX_RX_QUEUES];
 };
 
 #define VMXNET3_REV_6		5		/* Vmxnet3 Rev. 6 */
-- 
2.45.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-11-12 22:06:59.702403253 +0000
+++ 0032-net-vmxnet3-fix-potential-out-of-bounds-stats-access.patch	2024-11-12 22:06:58.683307454 +0000
@@ -1 +1 @@
-From d3a229dd493abcb29d5717c5ce37e0a0bc1777c4 Mon Sep 17 00:00:00 2001
+From c44cb537e88b037538c132dc742421812c72962c Mon Sep 17 00:00:00 2001
@@ -8,0 +9,2 @@
+[ upstream commit d3a229dd493abcb29d5717c5ce37e0a0bc1777c4 ]
+
@@ -33 +34,0 @@
-Cc: stable@dpdk.org
@@ -43 +44 @@
-index 79ab167421..619cfa21cf 100644
+index 52245c5fbb..5526f7d8fd 100644
@@ -46 +47 @@
-@@ -1471,42 +1471,52 @@ vmxnet3_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
+@@ -1377,42 +1377,52 @@ vmxnet3_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
@@ -109 +110 @@
-@@ -1522,8 +1532,6 @@ vmxnet3_dev_stats_reset(struct rte_eth_dev *dev)
+@@ -1428,8 +1438,6 @@ vmxnet3_dev_stats_reset(struct rte_eth_dev *dev)
@@ -119 +120 @@
-index 2b3e2c4caa..e9ded6663d 100644
+index 5a303717b1..ffd21ece79 100644
@@ -122 +123 @@
-@@ -121,8 +121,8 @@ struct vmxnet3_hw {
+@@ -120,8 +120,8 @@ struct vmxnet3_hw {
@@ -130,3 +131,3 @@
- 	uint16_t              tx_prod_offset;
- 	uint16_t              rx_prod_offset[2];
- 	/* device capability bit map */
+ };
+ 
+ #define VMXNET3_REV_6		5		/* Vmxnet3 Rev. 6 */