[PATCH v1 1/9] baseband/acc: protection for TB negative scenario

[Maxime Coquelin]

On 2/9/23 23:19, Nicolas Chautru wrote:
> Adding handling of negative scenario for malformed
> Transport Block mode operations.
> 
> Fixes: bec597b78a0 ("baseband/acc200: add LTE processing")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Nicolas Chautru <nicolas.chautru at intel.com>
> ---
>   drivers/baseband/acc/rte_vrb_pmd.c | 20 ++++++++++++++++++++
>   1 file changed, 20 insertions(+)
> 
> diff --git a/drivers/baseband/acc/rte_vrb_pmd.c b/drivers/baseband/acc/rte_vrb_pmd.c
> index 34e42d1f6e..797330a5dd 100644
> --- a/drivers/baseband/acc/rte_vrb_pmd.c
> +++ b/drivers/baseband/acc/rte_vrb_pmd.c
> @@ -1820,6 +1820,9 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
>   	r = op->turbo_enc.tb_params.r;
>   
>   	while (mbuf_total_left > 0 && r < c) {
> +		if (unlikely((input == NULL) || (output == NULL)))
> +			return -1;
> +
>   		seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
>   		/* Set up DMA descriptor */
>   		desc = acc_desc(q, total_enqueued_cbs);
> @@ -1854,6 +1857,10 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
>   		r++;
>   	}
>   
> +	/* In case the number of CB doesn't match, the configuration was invalid. */
> +	if (current_enqueued_cbs != cbs_in_tb)

Maybe wrap it with unlikely()?

> +		return -1;
> +
>   	/* Set SDone on last CB descriptor for TB mode. */
>   	desc->req.sdone_enable = 1;
>   
> @@ -2100,6 +2107,9 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
>   	}
>   
>   	while (mbuf_total_left > 0 && r < c) {
> +		if (unlikely((input == NULL) || (h_output == NULL)))
> +			return -1;
> +
>   		if (check_bit(op->ldpc_dec.op_flags, RTE_BBDEV_LDPC_DEC_SCATTER_GATHER))
>   			seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
>   		else
> @@ -2145,6 +2155,10 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
>   		r++;
>   	}
>   
> +	/* In case the number of CB doesn't match, the configuration was invalid. */
> +	if (current_enqueued_cbs != cbs_in_tb)
> +		return -1;
> +
>   #ifdef RTE_LIBRTE_BBDEV_DEBUG
>   	if (check_mbuf_total_left(mbuf_total_left) != 0)
>   		return -EINVAL;
> @@ -2187,6 +2201,8 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
>   	r = op->turbo_dec.tb_params.r;
>   
>   	while (mbuf_total_left > 0 && r < c) {
> +		if (unlikely((input == NULL) || (h_output == NULL)))
> +			return -1;
>   
>   		seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
>   
> @@ -2237,6 +2253,10 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
>   		r++;
>   	}
>   
> +	/* In case the number of CB doesn't match, the configuration was invalid. */
> +	if (current_enqueued_cbs != cbs_in_tb)
> +		return -1;
> +
>   	/* Set SDone on last CB descriptor for TB mode */
>   	desc->req.sdone_enable = 1;
>   

Reviewed-by: Maxime Coquelin <maxime.coquelin at redhat.com>

Thanks,
Maxime