patch 'baseband/acc: protect from TB negative scenario' has been queued to stable release 22.11.2

[Xueming Li]

Hi,

FYI, your patch has been queued to stable release 22.11.2

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 04/11/23. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://git.dpdk.org/dpdk-stable/log/?h=22.11-staging

This queued commit can be viewed at:
https://git.dpdk.org/dpdk-stable/log/?h=22.11-staging/commit/63797158c21f45dd60ea5b69d3ae91e1c6913e25

Thanks.

Xueming Li <xuemingl at nvidia.com>

---
>From 63797158c21f45dd60ea5b69d3ae91e1c6913e25 Mon Sep 17 00:00:00 2001
From: Nicolas Chautru <nicolas.chautru at intel.com>
Date: Fri, 10 Feb 2023 17:58:33 +0000
Subject: [PATCH] baseband/acc: protect from TB negative scenario
Cc: Xueming Li <xuemingl at nvidia.com>

[ upstream commit 68baaa839250a2a124143b34d4119f218c815d21 ]

Adding handling of negative scenario for malformed
Transport Block mode operations.

Fixes: bec597b78a0e ("baseband/acc200: add LTE processing")

Signed-off-by: Nicolas Chautru <nicolas.chautru at intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin at redhat.com>
---
 drivers/baseband/acc/rte_acc200_pmd.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/baseband/acc/rte_acc200_pmd.c b/drivers/baseband/acc/rte_acc200_pmd.c
index c5123cfef0..fe4be5b42b 100644
--- a/drivers/baseband/acc/rte_acc200_pmd.c
+++ b/drivers/baseband/acc/rte_acc200_pmd.c
@@ -1848,6 +1848,9 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
 	r = op->turbo_enc.tb_params.r;
 
 	while (mbuf_total_left > 0 && r < c) {
+		if (unlikely((input == NULL) || (output == NULL)))
+			return -1;
+
 		seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
 		/* Set up DMA descriptor */
 		desc = acc_desc(q, total_enqueued_cbs);
@@ -1882,6 +1885,10 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
 		r++;
 	}
 
+	/* In case the number of CB doesn't match, the configuration was invalid. */
+	if (unlikely(current_enqueued_cbs != cbs_in_tb))
+		return -1;
+
 	/* Set SDone on last CB descriptor for TB mode. */
 	desc->req.sdone_enable = 1;
 
@@ -2128,6 +2135,9 @@ enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
 	}
 
 	while (mbuf_total_left > 0 && r < c) {
+		if (unlikely((input == NULL) || (h_output == NULL)))
+			return -1;
+
 		if (check_bit(op->ldpc_dec.op_flags, RTE_BBDEV_LDPC_DEC_SCATTER_GATHER))
 			seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
 		else
@@ -2173,6 +2183,10 @@ enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
 		r++;
 	}
 
+	/* In case the number of CB doesn't match, the configuration was invalid. */
+	if (unlikely(current_enqueued_cbs != cbs_in_tb))
+		return -1;
+
 #ifdef RTE_LIBRTE_BBDEV_DEBUG
 	if (check_mbuf_total_left(mbuf_total_left) != 0)
 		return -EINVAL;
@@ -2215,6 +2229,8 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
 	r = op->turbo_dec.tb_params.r;
 
 	while (mbuf_total_left > 0 && r < c) {
+		if (unlikely((input == NULL) || (h_output == NULL)))
+			return -1;
 
 		seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
 
@@ -2265,6 +2281,10 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
 		r++;
 	}
 
+	/* In case the number of CB doesn't match, the configuration was invalid. */
+	if (unlikely(current_enqueued_cbs != cbs_in_tb))
+		return -1;
+
 	/* Set SDone on last CB descriptor for TB mode */
 	desc->req.sdone_enable = 1;
 
-- 
2.25.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2023-04-09 21:45:39.036946100 +0800
+++ 0008-baseband-acc-protect-from-TB-negative-scenario.patch	2023-04-09 21:45:38.579042200 +0800
@@ -1 +1 @@
-From 68baaa839250a2a124143b34d4119f218c815d21 Mon Sep 17 00:00:00 2001
+From 63797158c21f45dd60ea5b69d3ae91e1c6913e25 Mon Sep 17 00:00:00 2001
@@ -4,0 +5,3 @@
+Cc: Xueming Li <xuemingl at nvidia.com>
+
+[ upstream commit 68baaa839250a2a124143b34d4119f218c815d21 ]
@@ -10 +12,0 @@
-Cc: stable at dpdk.org
@@ -15 +17 @@
- drivers/baseband/acc/rte_vrb_pmd.c | 20 ++++++++++++++++++++
+ drivers/baseband/acc/rte_acc200_pmd.c | 20 ++++++++++++++++++++
@@ -18,5 +20,5 @@
-diff --git a/drivers/baseband/acc/rte_vrb_pmd.c b/drivers/baseband/acc/rte_vrb_pmd.c
-index 34e42d1f6e..3afaea71a3 100644
---- a/drivers/baseband/acc/rte_vrb_pmd.c
-+++ b/drivers/baseband/acc/rte_vrb_pmd.c
-@@ -1820,6 +1820,9 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
+diff --git a/drivers/baseband/acc/rte_acc200_pmd.c b/drivers/baseband/acc/rte_acc200_pmd.c
+index c5123cfef0..fe4be5b42b 100644
+--- a/drivers/baseband/acc/rte_acc200_pmd.c
++++ b/drivers/baseband/acc/rte_acc200_pmd.c
+@@ -1848,6 +1848,9 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
@@ -32 +34 @@
-@@ -1854,6 +1857,10 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
+@@ -1882,6 +1885,10 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
@@ -43 +45 @@
-@@ -2100,6 +2107,9 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
+@@ -2128,6 +2135,9 @@ enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
@@ -53 +55 @@
-@@ -2145,6 +2155,10 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
+@@ -2173,6 +2183,10 @@ enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
@@ -64 +66 @@
-@@ -2187,6 +2201,8 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
+@@ -2215,6 +2229,8 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
@@ -73 +75 @@
-@@ -2237,6 +2253,10 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
+@@ -2265,6 +2281,10 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,