patch 'net/ice: check illegal packet sizes' has been queued to stable release 19.11.14

[christian.ehrhardt at canonical.com]

Hi,

FYI, your patch has been queued to stable release 19.11.14

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/18/22. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/cpaelzer/dpdk-stable-queue

This queued commit can be viewed at:
https://github.com/cpaelzer/dpdk-stable-queue/commit/2ed40158257f2739a69b7689d7f24b5ce79a7a9a

Thanks.

Christian Ehrhardt <christian.ehrhardt at canonical.com>

---
>From 2ed40158257f2739a69b7689d7f24b5ce79a7a9a Mon Sep 17 00:00:00 2001
From: Kevin Liu <kevinx.liu at intel.com>
Date: Tue, 27 Sep 2022 07:15:22 +0000
Subject: [PATCH] net/ice: check illegal packet sizes

[ upstream commit ccf33dccf7aaf208ef67ed7b8ef45d05bce5e3a5 ]

If the length of data_len in mbuf is less than 17 or
greater than the maximum frame size, it is illegal.

These illegal packets will lead to Tx/Rx hang and
can't recover automatically.

This patch check those illegal packets and protect
Tx/Rx from hanging.

Fixes: 17c7d0f9d6a4 ("net/ice: support basic Rx/Tx")

Signed-off-by: Kevin Liu <kevinx.liu at intel.com>
Acked-by: Qi Zhang <qi.z.zhang at intel.com>
---
 drivers/net/ice/ice_rxtx.c | 11 +++++++++++
 drivers/net/ice/ice_rxtx.h |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/drivers/net/ice/ice_rxtx.c b/drivers/net/ice/ice_rxtx.c
index 53f336e85e..f97d93a78d 100644
--- a/drivers/net/ice/ice_rxtx.c
+++ b/drivers/net/ice/ice_rxtx.c
@@ -2955,6 +2955,9 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 	int i, ret;
 	uint64_t ol_flags;
 	struct rte_mbuf *m;
+	struct ice_tx_queue *txq = tx_queue;
+	struct rte_eth_dev *dev = &rte_eth_devices[txq->port_id];
+	uint16_t max_frame_size = dev->data->mtu + ICE_ETH_OVERHEAD;
 
 	for (i = 0; i < nb_pkts; i++) {
 		m = tx_pkts[i];
@@ -2971,6 +2974,14 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 			return i;
 		}
 
+		/* check the data_len in mbuf */
+		if (m->data_len < ICE_TX_MIN_PKT_LEN ||
+			m->data_len > max_frame_size) {
+			rte_errno = EINVAL;
+			PMD_DRV_LOG(ERR, "INVALID mbuf: bad data_len=[%hu]", m->data_len);
+			return i;
+		}
+
 #ifdef RTE_LIBRTE_ETHDEV_DEBUG
 		ret = rte_validate_tx_offload(m);
 		if (ret != 0) {
diff --git a/drivers/net/ice/ice_rxtx.h b/drivers/net/ice/ice_rxtx.h
index 16fd9cbaf9..54117bcb4b 100644
--- a/drivers/net/ice/ice_rxtx.h
+++ b/drivers/net/ice/ice_rxtx.h
@@ -38,6 +38,8 @@
 
 #define ICE_FDIR_PKT_LEN	512
 
+#define ICE_TX_MIN_PKT_LEN 17
+
 typedef void (*ice_rx_release_mbufs_t)(struct ice_rx_queue *rxq);
 typedef void (*ice_tx_release_mbufs_t)(struct ice_tx_queue *txq);
 
-- 
2.38.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2022-11-11 12:35:05.683251410 +0100
+++ 0025-net-ice-check-illegal-packet-sizes.patch	2022-11-11 12:35:04.769192040 +0100
@@ -1 +1 @@
-From ccf33dccf7aaf208ef67ed7b8ef45d05bce5e3a5 Mon Sep 17 00:00:00 2001
+From 2ed40158257f2739a69b7689d7f24b5ce79a7a9a Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit ccf33dccf7aaf208ef67ed7b8ef45d05bce5e3a5 ]
+
@@ -16 +17,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
-index 5af7c0c8f6..d1e1fadf9d 100644
+index 53f336e85e..f97d93a78d 100644
@@ -29 +30 @@
-@@ -3442,6 +3442,9 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
+@@ -2955,6 +2955,9 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
@@ -39 +40 @@
-@@ -3458,6 +3461,14 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
+@@ -2971,6 +2974,14 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
@@ -51 +52 @@
- #ifdef RTE_ETHDEV_DEBUG_TX
+ #ifdef RTE_LIBRTE_ETHDEV_DEBUG
@@ -55 +56 @@
-index 6c08c175dc..e1d4fe8e47 100644
+index 16fd9cbaf9..54117bcb4b 100644
@@ -58 +59 @@
-@@ -40,6 +40,8 @@
+@@ -38,6 +38,8 @@
@@ -60 +61 @@
- #define ICE_RXDID_COMMS_OVS	22
+ #define ICE_FDIR_PKT_LEN	512
@@ -64,2 +65,2 @@
- extern uint64_t ice_timestamp_dynflag;
- extern int ice_timestamp_dynfield_offset;
+ typedef void (*ice_rx_release_mbufs_t)(struct ice_rx_queue *rxq);
+ typedef void (*ice_tx_release_mbufs_t)(struct ice_tx_queue *txq);