patch 'net/iavf: check illegal packet sizes' has been queued to stable release 20.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 20.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/05/22. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/4f523b99acacdee90cdc42b3e85ec9e48e975388

Thanks.

Luca Boccassi

---
>From 4f523b99acacdee90cdc42b3e85ec9e48e975388 Mon Sep 17 00:00:00 2001
From: Kevin Liu <kevinx.liu at intel.com>
Date: Tue, 27 Sep 2022 07:15:21 +0000
Subject: [PATCH] net/iavf: check illegal packet sizes

[ upstream commit 19ee91c6bd9a196b17394d69b18576a7ff8e2489 ]

If the length of data_len in mbuf is less than 17 or
greater than the maximum frame size, it is illegal.

These illegal packets will lead to Tx/Rx hang and
can't recover automatically.

This patch check those illegal packets and protect
Tx/Rx from hanging.

Fixes: a2b29a7733ef ("net/avf: enable basic Rx Tx")

Signed-off-by: Kevin Liu <kevinx.liu at intel.com>
Acked-by: Qi Zhang <qi.z.zhang at intel.com>
---
 drivers/net/iavf/iavf_rxtx.c | 13 ++++++++++++-
 drivers/net/iavf/iavf_rxtx.h |  2 ++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/net/iavf/iavf_rxtx.c b/drivers/net/iavf/iavf_rxtx.c
index f6049d8694..0053a36de2 100644
--- a/drivers/net/iavf/iavf_rxtx.c
+++ b/drivers/net/iavf/iavf_rxtx.c
@@ -2329,12 +2329,15 @@ end_of_tx:
 
 /* TX prep functions */
 uint16_t
-iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
+iavf_prep_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
 	      uint16_t nb_pkts)
 {
 	int i, ret;
 	uint64_t ol_flags;
 	struct rte_mbuf *m;
+	struct iavf_tx_queue *txq = tx_queue;
+	struct rte_eth_dev *dev = &rte_eth_devices[txq->port_id];
+	uint16_t max_frame_size = dev->data->mtu + IAVF_ETH_OVERHEAD;
 
 	for (i = 0; i < nb_pkts; i++) {
 		m = tx_pkts[i];
@@ -2358,6 +2361,14 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 			return i;
 		}
 
+		/* check the data_len in mbuf */
+		if (m->data_len < IAVF_TX_MIN_PKT_LEN ||
+			m->data_len > max_frame_size) {
+			rte_errno = EINVAL;
+			PMD_DRV_LOG(ERR, "INVALID mbuf: bad data_len=[%hu]", m->data_len);
+			return i;
+		}
+
 #ifdef RTE_LIBRTE_ETHDEV_DEBUG
 		ret = rte_validate_tx_offload(m);
 		if (ret != 0) {
diff --git a/drivers/net/iavf/iavf_rxtx.h b/drivers/net/iavf/iavf_rxtx.h
index 557a7e46a7..047743de4f 100644
--- a/drivers/net/iavf/iavf_rxtx.h
+++ b/drivers/net/iavf/iavf_rxtx.h
@@ -39,6 +39,8 @@
 #define IAVF_TSO_MAX_SEG          UINT8_MAX
 #define IAVF_TX_MAX_MTU_SEG       8
 
+#define IAVF_TX_MIN_PKT_LEN 17
+
 #define IAVF_TX_CKSUM_OFFLOAD_MASK (		 \
 		PKT_TX_IP_CKSUM |		 \
 		PKT_TX_L4_MASK |		 \
-- 
2.34.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2022-11-03 09:27:28.463235768 +0000
+++ 0050-net-iavf-check-illegal-packet-sizes.patch	2022-11-03 09:27:25.449423912 +0000
@@ -1 +1 @@
-From 19ee91c6bd9a196b17394d69b18576a7ff8e2489 Mon Sep 17 00:00:00 2001
+From 4f523b99acacdee90cdc42b3e85ec9e48e975388 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 19ee91c6bd9a196b17394d69b18576a7ff8e2489 ]
+
@@ -16 +17,0 @@
-Cc: stable at dpdk.org
@@ -21,3 +22,3 @@
- drivers/net/iavf/iavf_rxtx.c | 9 +++++++++
- drivers/net/iavf/iavf_rxtx.h | 2 ++
- 2 files changed, 11 insertions(+)
+ drivers/net/iavf/iavf_rxtx.c | 13 ++++++++++++-
+ drivers/net/iavf/iavf_rxtx.h |  2 ++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
@@ -26 +27 @@
-index fc5d9e38cc..89a1d141ba 100644
+index f6049d8694..0053a36de2 100644
@@ -29 +30,10 @@
-@@ -2916,6 +2916,7 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
+@@ -2329,12 +2329,15 @@ end_of_tx:
+ 
+ /* TX prep functions */
+ uint16_t
+-iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
++iavf_prep_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
+ 	      uint16_t nb_pkts)
+ {
+ 	int i, ret;
+ 	uint64_t ol_flags;
@@ -31,2 +41,2 @@
- 	struct iavf_tx_queue *txq = tx_queue;
- 	struct rte_eth_dev *dev = &rte_eth_devices[txq->port_id];
++	struct iavf_tx_queue *txq = tx_queue;
++	struct rte_eth_dev *dev = &rte_eth_devices[txq->port_id];
@@ -34,2 +43,0 @@
- 	struct iavf_info *vf = IAVF_DEV_PRIVATE_TO_VF(dev->data->dev_private);
- 	struct iavf_adapter *adapter = IAVF_DEV_PRIVATE_TO_ADAPTER(dev->data->dev_private);
@@ -37 +45,3 @@
-@@ -2944,6 +2945,14 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
+ 	for (i = 0; i < nb_pkts; i++) {
+ 		m = tx_pkts[i];
+@@ -2358,6 +2361,14 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
@@ -49 +59 @@
- #ifdef RTE_ETHDEV_DEBUG_TX
+ #ifdef RTE_LIBRTE_ETHDEV_DEBUG
@@ -53 +63 @@
-index 66e832713c..3c89303980 100644
+index 557a7e46a7..047743de4f 100644
@@ -56 +66 @@
-@@ -55,6 +55,8 @@
+@@ -39,6 +39,8 @@
@@ -63,2 +73,2 @@
- 		RTE_MBUF_F_TX_IP_CKSUM |		 \
- 		RTE_MBUF_F_TX_L4_MASK |		 \
+ 		PKT_TX_IP_CKSUM |		 \
+ 		PKT_TX_L4_MASK |		 \