[dpdk-stable] patch 'net/bnxt: fix possible stack smashing' has been queued to stable release 19.11.3

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 19.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 05/21/20. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Thanks.

Luca Boccassi

---
>From 6c8f2aef2f40eeda2cc2c870395d7e89b997a200 Mon Sep 17 00:00:00 2001
From: Linsi Yuan <yuanlinsi01 at baidu.com>
Date: Thu, 30 Apr 2020 21:37:52 +0800
Subject: [PATCH] net/bnxt: fix possible stack smashing

[ upstream commit 6ebabb76a57c02681a01e07bf8016e4308c14c7c ]

We see a stack smashing as a result of defensive code missing. Once the
nb_pkts is less than RTE_BNXT_DESCS_PER_LOOP, it will be modified to
zero after doing a floor align, and we can not exit the following
receiving packets loop. And the buffers will be overwrite, then the
stack frame was ruined.

Fix the problem by adding defensive code, once the nb_pkts is zero, just
directly return with no packets.

Fixes: bc4a000f2f53 ("net/bnxt: implement SSE vector mode")

Signed-off-by: Linsi Yuan <yuanlinsi01 at baidu.com>
Signed-off-by: Dongsheng Rong <rongdongsheng at baidu.com>
Acked-by: Lance Richardson <lance.richardson at broadcom.com>
Reviewed-by: Ajit Khaparde <ajit.khaparde at broadcom.com>
---
 drivers/net/bnxt/bnxt_rxtx_vec_sse.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/bnxt/bnxt_rxtx_vec_sse.c b/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
index 31457300a7..8b4c396821 100644
--- a/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
+++ b/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
@@ -233,8 +233,13 @@ bnxt_recv_pkts_vec(void *rx_queue, struct rte_mbuf **rx_pkts,
 	/* Return no more than RTE_BNXT_MAX_RX_BURST per call. */
 	nb_pkts = RTE_MIN(nb_pkts, RTE_BNXT_MAX_RX_BURST);
 
-	/* Make nb_pkts an integer multiple of RTE_BNXT_DESCS_PER_LOOP */
+	/*
+	 * Make nb_pkts an integer multiple of RTE_BNXT_DESCS_PER_LOOP.
+	 * nb_pkts < RTE_BNXT_DESCS_PER_LOOP, just return no packet
+	 */
 	nb_pkts = RTE_ALIGN_FLOOR(nb_pkts, RTE_BNXT_DESCS_PER_LOOP);
+	if (!nb_pkts)
+		return 0;
 
 	/* Handle RX burst request */
 	while (1) {
-- 
2.20.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2020-05-19 14:04:52.186426245 +0100
+++ 0187-net-bnxt-fix-possible-stack-smashing.patch	2020-05-19 14:04:44.536654173 +0100
@@ -1,8 +1,10 @@
-From 6ebabb76a57c02681a01e07bf8016e4308c14c7c Mon Sep 17 00:00:00 2001
+From 6c8f2aef2f40eeda2cc2c870395d7e89b997a200 Mon Sep 17 00:00:00 2001
 From: Linsi Yuan <yuanlinsi01 at baidu.com>
 Date: Thu, 30 Apr 2020 21:37:52 +0800
 Subject: [PATCH] net/bnxt: fix possible stack smashing
 
+[ upstream commit 6ebabb76a57c02681a01e07bf8016e4308c14c7c ]
+
 We see a stack smashing as a result of defensive code missing. Once the
 nb_pkts is less than RTE_BNXT_DESCS_PER_LOOP, it will be modified to
 zero after doing a floor align, and we can not exit the following
@@ -13,7 +15,6 @@
 directly return with no packets.
 
 Fixes: bc4a000f2f53 ("net/bnxt: implement SSE vector mode")
-Cc: stable at dpdk.org
 
 Signed-off-by: Linsi Yuan <yuanlinsi01 at baidu.com>
 Signed-off-by: Dongsheng Rong <rongdongsheng at baidu.com>
@@ -24,7 +25,7 @@
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/drivers/net/bnxt/bnxt_rxtx_vec_sse.c b/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
-index d0e7910e77..8f73add9be 100644
+index 31457300a7..8b4c396821 100644
 --- a/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
 +++ b/drivers/net/bnxt/bnxt_rxtx_vec_sse.c
 @@ -233,8 +233,13 @@ bnxt_recv_pkts_vec(void *rx_queue, struct rte_mbuf **rx_pkts,