[dpdk-stable] patch 'net/bnxt: fix dereference before null check' has been queued to LTS release 17.11.10

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to LTS release 17.11.10

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/21/19. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Thanks.

Luca Boccassi

---
>From c7b19550a9910153efcae7cc0e25dde6fca1cd0d Mon Sep 17 00:00:00 2001
From: Kalesh AP <kalesh-anakkur.purayil at broadcom.com>
Date: Wed, 9 Oct 2019 14:16:17 +0530
Subject: [PATCH] net/bnxt: fix dereference before null check

[ upstream commit 5e592e8d4091da4ad1faadd9c3719bd4c245cca4 ]

This patch fixes potential null pointer access in bnxt_alloc_ag_data().
Fix to return an error if null check is true.

Fixes: daef48efe5e5 ("net/bnxt: support set MTU")

Signed-off-by: Kalesh AP <kalesh-anakkur.purayil at broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur at broadcom.com>
Reviewed-by: Ajit Khaparde <ajit.khaparde at broadcom.com>
---
 drivers/net/bnxt/bnxt_rxr.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_rxr.c b/drivers/net/bnxt/bnxt_rxr.c
index 95bba9d58f..6f916753cb 100644
--- a/drivers/net/bnxt/bnxt_rxr.c
+++ b/drivers/net/bnxt/bnxt_rxr.c
@@ -87,17 +87,21 @@ static inline int bnxt_alloc_ag_data(struct bnxt_rx_queue *rxq,
 	struct bnxt_sw_rx_bd *rx_buf = &rxr->ag_buf_ring[prod];
 	struct rte_mbuf *data;
 
-	data = __bnxt_alloc_rx_data(rxq->mb_pool);
-	if (!data) {
-		rte_atomic64_inc(&rxq->bp->rx_mbuf_alloc_fail);
-		return -ENOMEM;
-	}
-
-	if (rxbd == NULL)
+	if (rxbd == NULL) {
 		RTE_LOG(ERR, PMD, "Jumbo Frame. rxbd is NULL\n");
-	if (rx_buf == NULL)
+		return -EINVAL;
+	}
+
+	if (rx_buf == NULL) {
 		RTE_LOG(ERR, PMD, "Jumbo Frame. rx_buf is NULL\n");
+		return -EINVAL;
+	}
 
+	data = __bnxt_alloc_rx_data(rxq->mb_pool);
+	if (!data) {
+		rte_atomic64_inc(&rxq->bp->rx_mbuf_alloc_fail);
+		return -ENOMEM;
+	}
 
 	rx_buf->mbuf = data;
 
-- 
2.20.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2019-12-19 14:32:28.949479725 +0000
+++ 0066-net-bnxt-fix-dereference-before-null-check.patch	2019-12-19 14:32:26.145298619 +0000
@@ -1,13 +1,14 @@
-From 5e592e8d4091da4ad1faadd9c3719bd4c245cca4 Mon Sep 17 00:00:00 2001
+From c7b19550a9910153efcae7cc0e25dde6fca1cd0d Mon Sep 17 00:00:00 2001
 From: Kalesh AP <kalesh-anakkur.purayil at broadcom.com>
 Date: Wed, 9 Oct 2019 14:16:17 +0530
 Subject: [PATCH] net/bnxt: fix dereference before null check
 
+[ upstream commit 5e592e8d4091da4ad1faadd9c3719bd4c245cca4 ]
+
 This patch fixes potential null pointer access in bnxt_alloc_ag_data().
 Fix to return an error if null check is true.
 
 Fixes: daef48efe5e5 ("net/bnxt: support set MTU")
-Cc: stable at dpdk.org
 
 Signed-off-by: Kalesh AP <kalesh-anakkur.purayil at broadcom.com>
 Reviewed-by: Somnath Kotur <somnath.kotur at broadcom.com>
@@ -17,39 +18,39 @@
  1 file changed, 12 insertions(+), 8 deletions(-)
 
 diff --git a/drivers/net/bnxt/bnxt_rxr.c b/drivers/net/bnxt/bnxt_rxr.c
-index f0f9b020b1..03dae571b6 100644
+index 95bba9d58f..6f916753cb 100644
 --- a/drivers/net/bnxt/bnxt_rxr.c
 +++ b/drivers/net/bnxt/bnxt_rxr.c
-@@ -63,17 +63,21 @@ static inline int bnxt_alloc_ag_data(struct bnxt_rx_queue *rxq,
+@@ -87,17 +87,21 @@ static inline int bnxt_alloc_ag_data(struct bnxt_rx_queue *rxq,
  	struct bnxt_sw_rx_bd *rx_buf = &rxr->ag_buf_ring[prod];
- 	struct rte_mbuf *mbuf;
+ 	struct rte_mbuf *data;
  
--	mbuf = __bnxt_alloc_rx_data(rxq->mb_pool);
--	if (!mbuf) {
--		rte_atomic64_inc(&rxq->rx_mbuf_alloc_fail);
+-	data = __bnxt_alloc_rx_data(rxq->mb_pool);
+-	if (!data) {
+-		rte_atomic64_inc(&rxq->bp->rx_mbuf_alloc_fail);
 -		return -ENOMEM;
 -	}
 -
 -	if (rxbd == NULL)
 +	if (rxbd == NULL) {
- 		PMD_DRV_LOG(ERR, "Jumbo Frame. rxbd is NULL\n");
+ 		RTE_LOG(ERR, PMD, "Jumbo Frame. rxbd is NULL\n");
 -	if (rx_buf == NULL)
 +		return -EINVAL;
 +	}
 +
 +	if (rx_buf == NULL) {
- 		PMD_DRV_LOG(ERR, "Jumbo Frame. rx_buf is NULL\n");
+ 		RTE_LOG(ERR, PMD, "Jumbo Frame. rx_buf is NULL\n");
 +		return -EINVAL;
 +	}
  
-+	mbuf = __bnxt_alloc_rx_data(rxq->mb_pool);
-+	if (!mbuf) {
-+		rte_atomic64_inc(&rxq->rx_mbuf_alloc_fail);
++	data = __bnxt_alloc_rx_data(rxq->mb_pool);
++	if (!data) {
++		rte_atomic64_inc(&rxq->bp->rx_mbuf_alloc_fail);
 +		return -ENOMEM;
 +	}
  
- 	rx_buf->mbuf = mbuf;
- 	mbuf->data_off = RTE_PKTMBUF_HEADROOM;
+ 	rx_buf->mbuf = data;
+ 
 -- 
 2.20.1