From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 8E3FF45C9B for ; Tue, 12 Nov 2024 23:09:58 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 85F894064C; Tue, 12 Nov 2024 23:09:58 +0100 (CET) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mails.dpdk.org (Postfix) with ESMTP id E66F940A8B for ; Tue, 12 Nov 2024 23:09:56 +0100 (CET) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4315e62afe0so59129335e9.1 for ; Tue, 12 Nov 2024 14:09:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1731449396; x=1732054196; darn=dpdk.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=JH7sLjt/FJLqMeEQNvjyMRkQUujZ2WDIFCFigPl9GxM=; b=GO9ZTrvMC0d+1LawrzdH1m/dkQvWBQlhMFy2PLvAwIHly0JAQmUwDKBL3TKrCwxLry nX3cWhtvvqS8u6vXMyjO+tfkxre+g44rqhV3J+SVr3npgU0uhrePIylw5CsTCTdVp9xF 3vk4NjyZ47ACQi9ze0XnTvR/mCV8XdeqWSb+V09aW74Uef0SlPEoiR33avB3Kxkal+AL YKeMHr25rC7CFfvRUtl21MVCq4w7aJDaDbbra/Ha0f2qaREhfuZLMVryPpzuVrjeVmH0 jRSdzbxoHn8VvpuS3HEnokAnipDSLdbEEK8vxvTy4cEur18ytioVrMPVe+iKvwfvdli8 lo7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1731449396; x=1732054196; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JH7sLjt/FJLqMeEQNvjyMRkQUujZ2WDIFCFigPl9GxM=; b=GWxwhMsP+xWTQ9566KHKM9cs/0G4zpzMZf0k2t7r0MzRJAldAssJybhP8UI0G1kTug 6HRFv7FA+P1HagFV0n2dPfWgqGO+X4fg2gXue6wj48++aT4/R71cSl3i55qLZquGqOqD EejvCpstKivCYv6Vhyk/6GtbQsNN+LEoi4lgvsptgukmoHc08AT990b+bQnmhTOJCmWG cLVEjTltCNNL8HvZP5LqAY3M0M3qrUbmh2gb/WPTM+AunGd6xskCoi4t/uoyamjJwmo7 YvSZaLXWHW3/zJbJkAcC6c2+QN8v92BUytS0dudtPJRfKiWjHNYjwnNk49x5fafrHKmu lMjw== X-Forwarded-Encrypted: i=1; AJvYcCX9DSq51QtYHaEUvk3bcp5NrC2tWodacOHlOH8utVfuyYMk4GsNDM8JkiCNLXc8bwTMn2/1Mdg=@dpdk.org X-Gm-Message-State: AOJu0YxFyAHAzsJQBxKrXhv3Y9opy8/n6CsqV0CxREVRyXUQNNudpdcG IK2335g6U21njmrC1CLiiTArDbgOBZPLxAz8/SdFtaNSfZEqUYUeqmJ+Ng== X-Google-Smtp-Source: AGHT+IGPC5SjkovPsXlnxMCrZY2+GTxDFvKfdEc9xc+NZH/WLGJoLr/yvrub7l6nID7+dj24hxmvEw== X-Received: by 2002:a05:600c:5493:b0:42e:75a6:bb60 with SMTP id 5b1f17b1804b1-432b7508b8amr164210225e9.19.1731449396439; Tue, 12 Nov 2024 14:09:56 -0800 (PST) Received: from localhost ([2a01:4b00:d036:ae00:e89d:e9a1:da72:2f9d]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-432d55045b0sm968325e9.22.2024.11.12.14.09.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Nov 2024 14:09:55 -0800 (PST) From: luca.boccassi@gmail.com To: =?UTF-8?q?Morten=20Br=C3=B8rup?= Cc: Ferruh Yigit , dpdk stable Subject: patch 'net/vmxnet3: fix potential out of bounds stats access' has been queued to stable release 22.11.7 Date: Tue, 12 Nov 2024 22:07:42 +0000 Message-ID: <20241112220754.666489-32-luca.boccassi@gmail.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20241112220754.666489-1-luca.boccassi@gmail.com> References: <20241023211704.1216956-79-luca.boccassi@gmail.com> <20241112220754.666489-1-luca.boccassi@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Hi, FYI, your patch has been queued to stable release 22.11.7 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 11/14/24. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://github.com/bluca/dpdk-stable This queued commit can be viewed at: https://github.com/bluca/dpdk-stable/commit/c44cb537e88b037538c132dc742421812c72962c Thanks. Luca Boccassi --- >From c44cb537e88b037538c132dc742421812c72962c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Morten=20Br=C3=B8rup?= Date: Mon, 4 Nov 2024 10:52:19 +0000 Subject: [PATCH] net/vmxnet3: fix potential out of bounds stats access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [ upstream commit d3a229dd493abcb29d5717c5ce37e0a0bc1777c4 ] With virtual hardware version 6, the max number of RX queues was increased to VMXNET3_EXT_MAX_RX_QUEUES (32) from VMXNET3_MAX_RX_QUEUES (16), similarly, the max number of TX queues was increased to VMXNET3_EXT_MAX_TX_QUEUES (32) from VMXNET3_MAX_TX_QUEUES (8). These increases were not fully considered in the PMD... The configured number of queues to provide statistics for (RTE_ETHDEV_QUEUE_STAT_CNTRS) can be smaller than driver's max number of supported transmit queues for virtual hardware version 6 (VMXNET3_EXT_MAX_RX_QUEUES) (32), which will cause accessing the queue stats array out of boundary if the application uses more than RTE_ETHDEV_QUEUE_STAT_CNTRS queues. This patch fixes this by two modifications - Increased stats array size to support hardware version 6. - Respect RTE_ETHDEV_QUEUE_STAT_CNTRS when getting the per-queue counters. The build time check RTE_BUILD_BUG_ON(RTE_ETHDEV_QUEUE_STAT_CNTRS < VMXNET3_MAX_TX_QUEUES) has become irrelevant, so it is removed. With this removal, per-queue stats for fewer queues is supported. Fixes: b1584dd0affe ("net/vmxnet3: support version 6") Signed-off-by: Morten Brørup Acked-by: Ferruh Yigit --- drivers/net/vmxnet3/vmxnet3_ethdev.c | 32 +++++++++++++++++----------- drivers/net/vmxnet3/vmxnet3_ethdev.h | 4 ++-- 2 files changed, 22 insertions(+), 14 deletions(-) diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c index 52245c5fbb..5526f7d8fd 100644 --- a/drivers/net/vmxnet3/vmxnet3_ethdev.c +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c @@ -1377,42 +1377,52 @@ vmxnet3_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats) struct vmxnet3_hw *hw = dev->data->dev_private; struct UPT1_TxStats txStats; struct UPT1_RxStats rxStats; + uint64_t packets, bytes; VMXNET3_WRITE_BAR1_REG(hw, VMXNET3_REG_CMD, VMXNET3_CMD_GET_STATS); for (i = 0; i < hw->num_tx_queues; i++) { vmxnet3_tx_stats_get(hw, i, &txStats); - stats->q_opackets[i] = txStats.ucastPktsTxOK + + packets = txStats.ucastPktsTxOK + txStats.mcastPktsTxOK + txStats.bcastPktsTxOK; - stats->q_obytes[i] = txStats.ucastBytesTxOK + + bytes = txStats.ucastBytesTxOK + txStats.mcastBytesTxOK + txStats.bcastBytesTxOK; - stats->opackets += stats->q_opackets[i]; - stats->obytes += stats->q_obytes[i]; + stats->opackets += packets; + stats->obytes += bytes; stats->oerrors += txStats.pktsTxError + txStats.pktsTxDiscard; + + if (i < RTE_ETHDEV_QUEUE_STAT_CNTRS) { + stats->q_opackets[i] = packets; + stats->q_obytes[i] = bytes; + } } for (i = 0; i < hw->num_rx_queues; i++) { vmxnet3_rx_stats_get(hw, i, &rxStats); - stats->q_ipackets[i] = rxStats.ucastPktsRxOK + + packets = rxStats.ucastPktsRxOK + rxStats.mcastPktsRxOK + rxStats.bcastPktsRxOK; - stats->q_ibytes[i] = rxStats.ucastBytesRxOK + + bytes = rxStats.ucastBytesRxOK + rxStats.mcastBytesRxOK + rxStats.bcastBytesRxOK; - stats->ipackets += stats->q_ipackets[i]; - stats->ibytes += stats->q_ibytes[i]; - - stats->q_errors[i] = rxStats.pktsRxError; + stats->ipackets += packets; + stats->ibytes += bytes; stats->ierrors += rxStats.pktsRxError; stats->imissed += rxStats.pktsRxOutOfBuf; + + if (i < RTE_ETHDEV_QUEUE_STAT_CNTRS) { + stats->q_ipackets[i] = packets; + stats->q_ibytes[i] = bytes; + stats->q_errors[i] = rxStats.pktsRxError; + } } return 0; @@ -1428,8 +1438,6 @@ vmxnet3_dev_stats_reset(struct rte_eth_dev *dev) VMXNET3_WRITE_BAR1_REG(hw, VMXNET3_REG_CMD, VMXNET3_CMD_GET_STATS); - RTE_BUILD_BUG_ON(RTE_ETHDEV_QUEUE_STAT_CNTRS < VMXNET3_MAX_TX_QUEUES); - for (i = 0; i < hw->num_tx_queues; i++) { vmxnet3_hw_tx_stats_get(hw, i, &txStats); memcpy(&hw->snapshot_tx_stats[i], &txStats, diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.h b/drivers/net/vmxnet3/vmxnet3_ethdev.h index 5a303717b1..ffd21ece79 100644 --- a/drivers/net/vmxnet3/vmxnet3_ethdev.h +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.h @@ -120,8 +120,8 @@ struct vmxnet3_hw { #define VMXNET3_VFT_TABLE_SIZE (VMXNET3_VFT_SIZE * sizeof(uint32_t)) UPT1_TxStats saved_tx_stats[VMXNET3_EXT_MAX_TX_QUEUES]; UPT1_RxStats saved_rx_stats[VMXNET3_EXT_MAX_RX_QUEUES]; - UPT1_TxStats snapshot_tx_stats[VMXNET3_MAX_TX_QUEUES]; - UPT1_RxStats snapshot_rx_stats[VMXNET3_MAX_RX_QUEUES]; + UPT1_TxStats snapshot_tx_stats[VMXNET3_EXT_MAX_TX_QUEUES]; + UPT1_RxStats snapshot_rx_stats[VMXNET3_EXT_MAX_RX_QUEUES]; }; #define VMXNET3_REV_6 5 /* Vmxnet3 Rev. 6 */ -- 2.45.2 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2024-11-12 22:06:59.702403253 +0000 +++ 0032-net-vmxnet3-fix-potential-out-of-bounds-stats-access.patch 2024-11-12 22:06:58.683307454 +0000 @@ -1 +1 @@ -From d3a229dd493abcb29d5717c5ce37e0a0bc1777c4 Mon Sep 17 00:00:00 2001 +From c44cb537e88b037538c132dc742421812c72962c Mon Sep 17 00:00:00 2001 @@ -8,0 +9,2 @@ +[ upstream commit d3a229dd493abcb29d5717c5ce37e0a0bc1777c4 ] + @@ -33 +34,0 @@ -Cc: stable@dpdk.org @@ -43 +44 @@ -index 79ab167421..619cfa21cf 100644 +index 52245c5fbb..5526f7d8fd 100644 @@ -46 +47 @@ -@@ -1471,42 +1471,52 @@ vmxnet3_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats) +@@ -1377,42 +1377,52 @@ vmxnet3_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats) @@ -109 +110 @@ -@@ -1522,8 +1532,6 @@ vmxnet3_dev_stats_reset(struct rte_eth_dev *dev) +@@ -1428,8 +1438,6 @@ vmxnet3_dev_stats_reset(struct rte_eth_dev *dev) @@ -119 +120 @@ -index 2b3e2c4caa..e9ded6663d 100644 +index 5a303717b1..ffd21ece79 100644 @@ -122 +123 @@ -@@ -121,8 +121,8 @@ struct vmxnet3_hw { +@@ -120,8 +120,8 @@ struct vmxnet3_hw { @@ -130,3 +131,3 @@ - uint16_t tx_prod_offset; - uint16_t rx_prod_offset[2]; - /* device capability bit map */ + }; + + #define VMXNET3_REV_6 5 /* Vmxnet3 Rev. 6 */