[dpdk-stable] patch 'net/octeontx2: fix corruption in segments list' has been queued to stable release 19.11.7

[Christian Ehrhardt]

Hi,

FYI, your patch has been queued to stable release 19.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 02/06/21. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/cpaelzer/dpdk-stable-queue

This queued commit can be viewed at:
https://github.com/cpaelzer/dpdk-stable-queue/commit/b4f38485f798b66aa2798182f9723fd23ddf03da

Thanks.

Christian Ehrhardt <christian.ehrhardt at canonical.com>

---
>From b4f38485f798b66aa2798182f9723fd23ddf03da Mon Sep 17 00:00:00 2001
From: Sunil Kumar Kori <skori at marvell.com>
Date: Mon, 21 Dec 2020 19:33:08 +0530
Subject: [PATCH] net/octeontx2: fix corruption in segments list

[ upstream commit 54b79ac220b16465bf67d2bd65e3098379a5ce25 ]

On Tx, lastseg->next is not being reset to null for multi segmented
packet and same mbuf can be used on Rx which has a stale mbuf entry into
mbuf->next.

On Rx, application receives mbuf with mbuf->next uninitialized though
mbuf->nb_segs is correct. Application iterates over all segments using
mbuf->next ignoring mbuf->nb_segs which leads to undefined behavior.

So earlier assumption of just having right value in mbuf->nb_segs is
enough, is incorrect. Mbuf must contain valid and synced value in
nb_segs and next pointer.

Fixes: 364eb0e46683 ("net/octeontx2: avoid per packet barrier with multi segment")

Signed-off-by: Sunil Kumar Kori <skori at marvell.com>
Acked-by: Nithin Dabilpuram <ndabilpuram at marvell.com>
---
 drivers/net/octeontx2/otx2_rx.c | 6 ++++++
 drivers/net/octeontx2/otx2_rx.h | 7 +++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/net/octeontx2/otx2_rx.c b/drivers/net/octeontx2/otx2_rx.c
index 48565db030..23d5c30b59 100644
--- a/drivers/net/octeontx2/otx2_rx.c
+++ b/drivers/net/octeontx2/otx2_rx.c
@@ -273,6 +273,12 @@ nix_recv_pkts_vector(void *rx_queue, struct rte_mbuf **rx_pkts,
 		vst1q_u64((uint64_t *)mbuf2->rearm_data, rearm2);
 		vst1q_u64((uint64_t *)mbuf3->rearm_data, rearm3);
 
+		/* Update that no more segments */
+		mbuf0->next = NULL;
+		mbuf1->next = NULL;
+		mbuf2->next = NULL;
+		mbuf3->next = NULL;
+
 		/* Store the mbufs to rx_pkts */
 		vst1q_u64((uint64_t *)&rx_pkts[packets], mbuf01);
 		vst1q_u64((uint64_t *)&rx_pkts[packets + 2], mbuf23);
diff --git a/drivers/net/octeontx2/otx2_rx.h b/drivers/net/octeontx2/otx2_rx.h
index 351ad0fcb4..1863bfde72 100644
--- a/drivers/net/octeontx2/otx2_rx.h
+++ b/drivers/net/octeontx2/otx2_rx.h
@@ -188,6 +188,7 @@ nix_cqe_xtract_mseg(const struct nix_rx_parse_s *rx,
 			iova_list = (const rte_iova_t *)(iova_list + 1);
 		}
 	}
+	mbuf->next = NULL;
 }
 
 static __rte_always_inline void
@@ -235,10 +236,12 @@ otx2_nix_cqe_to_mbuf(const struct nix_cqe_hdr_s *cq, const uint32_t tag,
 	*(uint64_t *)(&mbuf->rearm_data) = val;
 	mbuf->pkt_len = len;
 
-	if (flag & NIX_RX_MULTI_SEG_F)
+	if (flag & NIX_RX_MULTI_SEG_F) {
 		nix_cqe_xtract_mseg(rx, mbuf, val);
-	else
+	} else {
 		mbuf->data_len = len;
+		mbuf->next = NULL;
+	}
 }
 
 #define CKSUM_F NIX_RX_OFFLOAD_CHECKSUM_F
-- 
2.30.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2021-02-04 12:04:29.908512150 +0100
+++ 0043-net-octeontx2-fix-corruption-in-segments-list.patch	2021-02-04 12:04:27.954789655 +0100
@@ -1 +1 @@
-From 54b79ac220b16465bf67d2bd65e3098379a5ce25 Mon Sep 17 00:00:00 2001
+From b4f38485f798b66aa2798182f9723fd23ddf03da Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 54b79ac220b16465bf67d2bd65e3098379a5ce25 ]
+
@@ -19 +20,0 @@
-Cc: stable at dpdk.org
@@ -29 +30 @@
-index 2da8efe77c..ffeade5952 100644
+index 48565db030..23d5c30b59 100644
@@ -32 +33 @@
-@@ -279,6 +279,12 @@ nix_recv_pkts_vector(void *rx_queue, struct rte_mbuf **rx_pkts,
+@@ -273,6 +273,12 @@ nix_recv_pkts_vector(void *rx_queue, struct rte_mbuf **rx_pkts,
@@ -46 +47 @@
-index 926f614a4e..0ba3d3d96c 100644
+index 351ad0fcb4..1863bfde72 100644
@@ -49 +50 @@
-@@ -215,6 +215,7 @@ nix_cqe_xtract_mseg(const struct nix_rx_parse_s *rx,
+@@ -188,6 +188,7 @@ nix_cqe_xtract_mseg(const struct nix_rx_parse_s *rx,
@@ -56,2 +57,2 @@
- static __rte_always_inline uint16_t
-@@ -330,10 +331,12 @@ otx2_nix_cqe_to_mbuf(const struct nix_cqe_hdr_s *cq, const uint32_t tag,
+ static __rte_always_inline void
+@@ -235,10 +236,12 @@ otx2_nix_cqe_to_mbuf(const struct nix_cqe_hdr_s *cq, const uint32_t tag,