[dpdk-stable] patch 'net/ice: fix overflow in maximum packet length config' has been queued to stable release 20.11.3

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 20.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/14/21. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/345f2731ed564636d2b9380c8be01ab4aafc93d0

Thanks.

Luca Boccassi

---
>From 345f2731ed564636d2b9380c8be01ab4aafc93d0 Mon Sep 17 00:00:00 2001
From: Tudor Cornea <tudor.cornea at keysight.com>
Date: Tue, 15 Jun 2021 13:38:34 +0300
Subject: [PATCH] net/ice: fix overflow in maximum packet length config

[ upstream commit 58bb86cf13b8535fa8786f97cc9a4dfaa780a51e ]

The len variable, used in the computation of max_pkt_len could overflow,
if used to store the result of the following computation:

ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len

Since, we could define the mbuf size to have a large value (i.e 13312),
and ICE_SUPPORT_CHAIN_NUM is defined as 5, the computation mentioned
above could potentially result in a value which might be bigger than
MAX_USHORT.

The result will be that Jumbo Frames will not work properly

Fixes: 1b009275e2c8 ("net/ice: add Rx queue init in DCF")

Signed-off-by: Tudor Cornea <tudor.cornea at keysight.com>
Acked-by: Qi Zhang <qi.z.zhang at intel.com>
---
 drivers/net/ice/ice_dcf_ethdev.c | 7 ++++---
 drivers/net/ice/ice_rxtx.c       | 6 +++---
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ice/ice_dcf_ethdev.c b/drivers/net/ice/ice_dcf_ethdev.c
index e5c877805f..71f8a4b4cc 100644
--- a/drivers/net/ice/ice_dcf_ethdev.c
+++ b/drivers/net/ice/ice_dcf_ethdev.c
@@ -48,13 +48,14 @@ ice_dcf_init_rxq(struct rte_eth_dev *dev, struct ice_rx_queue *rxq)
 	struct ice_dcf_adapter *dcf_ad = dev->data->dev_private;
 	struct rte_eth_dev_data *dev_data = dev->data;
 	struct iavf_hw *hw = &dcf_ad->real_hw.avf;
-	uint16_t buf_size, max_pkt_len, len;
+	uint16_t buf_size, max_pkt_len;
 
 	buf_size = rte_pktmbuf_data_room_size(rxq->mp) - RTE_PKTMBUF_HEADROOM;
 	rxq->rx_hdr_len = 0;
 	rxq->rx_buf_len = RTE_ALIGN(buf_size, (1 << ICE_RLAN_CTX_DBUF_S));
-	len = ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len;
-	max_pkt_len = RTE_MIN(len, dev->data->dev_conf.rxmode.max_rx_pkt_len);
+	max_pkt_len = RTE_MIN((uint32_t)
+			      ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len,
+			      dev->data->dev_conf.rxmode.max_rx_pkt_len);
 
 	/* Check if the jumbo frame and maximum packet length are set
 	 * correctly.
diff --git a/drivers/net/ice/ice_rxtx.c b/drivers/net/ice/ice_rxtx.c
index f9a475cbb8..8ac9411083 100644
--- a/drivers/net/ice/ice_rxtx.c
+++ b/drivers/net/ice/ice_rxtx.c
@@ -231,7 +231,7 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq)
 	struct rte_eth_dev_data *dev_data = rxq->vsi->adapter->pf.dev_data;
 	struct ice_rlan_ctx rx_ctx;
 	enum ice_status err;
-	uint16_t buf_size, len;
+	uint16_t buf_size;
 	struct rte_eth_rxmode *rxmode = &dev_data->dev_conf.rxmode;
 	uint32_t rxdid = ICE_RXDID_COMMS_OVS;
 	uint32_t regval;
@@ -241,8 +241,8 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq)
 			      RTE_PKTMBUF_HEADROOM);
 	rxq->rx_hdr_len = 0;
 	rxq->rx_buf_len = RTE_ALIGN(buf_size, (1 << ICE_RLAN_CTX_DBUF_S));
-	len = ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len;
-	rxq->max_pkt_len = RTE_MIN(len,
+	rxq->max_pkt_len = RTE_MIN((uint32_t)
+				   ICE_SUPPORT_CHAIN_NUM * rxq->rx_buf_len,
 				   dev_data->dev_conf.rxmode.max_rx_pkt_len);
 
 	if (rxmode->offloads & DEV_RX_OFFLOAD_JUMBO_FRAME) {
-- 
2.30.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2021-07-12 13:41:39.121521578 +0100
+++ 0048-net-ice-fix-overflow-in-maximum-packet-length-config.patch	2021-07-12 13:41:36.362119944 +0100
@@ -1 +1 @@
-From 58bb86cf13b8535fa8786f97cc9a4dfaa780a51e Mon Sep 17 00:00:00 2001
+From 345f2731ed564636d2b9380c8be01ab4aafc93d0 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 58bb86cf13b8535fa8786f97cc9a4dfaa780a51e ]
+
@@ -19 +20,0 @@
-Cc: stable at dpdk.org
@@ -29 +30 @@
-index b937cbbb03..f73dc80bd9 100644
+index e5c877805f..71f8a4b4cc 100644
@@ -32 +33 @@
-@@ -54,13 +54,14 @@ ice_dcf_init_rxq(struct rte_eth_dev *dev, struct ice_rx_queue *rxq)
+@@ -48,13 +48,14 @@ ice_dcf_init_rxq(struct rte_eth_dev *dev, struct ice_rx_queue *rxq)
@@ -51 +52 @@
-index fc9bb5a3e7..20352b07af 100644
+index f9a475cbb8..8ac9411083 100644
@@ -54 +55 @@
-@@ -258,7 +258,7 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq)
+@@ -231,7 +231,7 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq)
@@ -63 +64 @@
-@@ -268,8 +268,8 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq)
+@@ -241,8 +241,8 @@ ice_program_hw_rx_queue(struct ice_rx_queue *rxq)