[dpdk-stable] patch 'net/mlx5: fix meter color register consideration' has been queued to stable release 19.11.3

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 19.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 05/21/20. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Thanks.

Luca Boccassi

---
>From 46cd8f27b1dd7a7ac17e125eb7d263e0682c651d Mon Sep 17 00:00:00 2001
From: Michael Baum <michaelba at mellanox.com>
Date: Wed, 6 May 2020 16:24:06 +0000
Subject: [PATCH] net/mlx5: fix meter color register consideration

[ upstream commit c8f0abe7f89d61a347ba9e2d3bf337c89c0fb16f ]

The mlx5_flow_get_reg_id() function translates tag ID to register
from the registers that are supported and available for use. The
user does not know which register is available at a time and therefore
there is an array that represents mapping to the available registers.
Usually the free registers are continuous in the flow_mreg_c array but
sometimes the mtr_color_reg register is between them and it must be
skipped and the next register returned, in which case the function
returns the mapping of the next entity in the array.

When the function reads from the next entity in the array, it does not
check whether such an entity exists and in some situation invalid access
to memory occurs beyond the array boundaries.

So, when all the registers are valid from HW perspective and the meter
color register is not the default, the tag id 5 causes an out of bound
access.

Validate registers availability when meter color register is not the
default.

Coverity issue: 146355
Fixes: 792e749e92d5 ("net/mlx5: fix register usage in meter")

Signed-off-by: Michael Baum <michaelba at mellanox.com>
Acked-by: Matan Azrad <matan at mellanox.com>
---
 drivers/net/mlx5/mlx5_flow.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 5fcff9a075..e05c35a417 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -432,6 +432,10 @@ mlx5_flow_get_reg_id(struct rte_eth_dev *dev,
 		 */
 		if (skip_mtr_reg && config->flow_mreg_c
 		    [id + start_reg - REG_C_0] >= priv->mtr_color_reg) {
+			if (id >= (REG_C_7 - start_reg))
+				return rte_flow_error_set(error, EINVAL,
+						       RTE_FLOW_ERROR_TYPE_ITEM,
+							NULL, "invalid tag id");
 			if (config->flow_mreg_c
 			    [id + 1 + start_reg - REG_C_0] != REG_NONE)
 				return config->flow_mreg_c
-- 
2.20.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2020-05-19 14:04:53.130573830 +0100
+++ 0209-net-mlx5-fix-meter-color-register-consideration.patch	2020-05-19 14:04:44.604655406 +0100
@@ -1,8 +1,10 @@
-From c8f0abe7f89d61a347ba9e2d3bf337c89c0fb16f Mon Sep 17 00:00:00 2001
+From 46cd8f27b1dd7a7ac17e125eb7d263e0682c651d Mon Sep 17 00:00:00 2001
 From: Michael Baum <michaelba at mellanox.com>
 Date: Wed, 6 May 2020 16:24:06 +0000
 Subject: [PATCH] net/mlx5: fix meter color register consideration
 
+[ upstream commit c8f0abe7f89d61a347ba9e2d3bf337c89c0fb16f ]
+
 The mlx5_flow_get_reg_id() function translates tag ID to register
 from the registers that are supported and available for use. The
 user does not know which register is available at a time and therefore
@@ -25,7 +27,6 @@
 
 Coverity issue: 146355
 Fixes: 792e749e92d5 ("net/mlx5: fix register usage in meter")
-Cc: stable at dpdk.org
 
 Signed-off-by: Michael Baum <michaelba at mellanox.com>
 Acked-by: Matan Azrad <matan at mellanox.com>
@@ -34,10 +35,10 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
-index 01376f3c51..08c7cdf005 100644
+index 5fcff9a075..e05c35a417 100644
 --- a/drivers/net/mlx5/mlx5_flow.c
 +++ b/drivers/net/mlx5/mlx5_flow.c
-@@ -442,6 +442,10 @@ mlx5_flow_get_reg_id(struct rte_eth_dev *dev,
+@@ -432,6 +432,10 @@ mlx5_flow_get_reg_id(struct rte_eth_dev *dev,
  		 */
  		if (skip_mtr_reg && config->flow_mreg_c
  		    [id + start_reg - REG_C_0] >= priv->mtr_color_reg) {