patch 'net/dpaa2: fix memory corruption in TM' has been queued to stable release 23.11.3

[Xueming Li]

Hi,

FYI, your patch has been queued to stable release 23.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/10/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://git.dpdk.org/dpdk-stable/log/?h=23.11-staging

This queued commit can be viewed at:
https://git.dpdk.org/dpdk-stable/commit/?h=23.11-staging&id=2069d39f4189a95a38b119191ce0a48c83f1a1d4

Thanks.

Xueming Li <xuemingl at nvidia.com>

---
>From 2069d39f4189a95a38b119191ce0a48c83f1a1d4 Mon Sep 17 00:00:00 2001
From: Gagandeep Singh <g.singh at nxp.com>
Date: Wed, 23 Oct 2024 17:29:47 +0530
Subject: [PATCH] net/dpaa2: fix memory corruption in TM
Cc: Xueming Li <xuemingl at nvidia.com>

[ upstream commit d77cb0c44cf6b68dc71684bd302fd3138b36e5f1 ]

driver was reserving memory in an array for 8 queues only,
but it can support many more queues configuration.

This patch fixes the memory corruption issue by defining the
queue array with correct size.

Fixes: 72100f0dee21 ("net/dpaa2: support level 2 in traffic management")

Signed-off-by: Gagandeep Singh <g.singh at nxp.com>
Acked-by: Hemant Agrawal <hemant.agrawal at nxp.com>
---
 drivers/net/dpaa2/dpaa2_tm.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_tm.c b/drivers/net/dpaa2/dpaa2_tm.c
index 3c0f282ec3..c4efdf0af8 100644
--- a/drivers/net/dpaa2/dpaa2_tm.c
+++ b/drivers/net/dpaa2/dpaa2_tm.c
@@ -684,6 +684,7 @@ dpaa2_hierarchy_commit(struct rte_eth_dev *dev, int clear_on_fail,
 	struct dpaa2_tm_node *leaf_node, *temp_leaf_node, *channel_node;
 	struct fsl_mc_io *dpni = (struct fsl_mc_io *)dev->process_private;
 	int ret, t;
+	bool conf_schedule = false;

 	/* Populate TCs */
 	LIST_FOREACH(channel_node, &priv->nodes, next) {
@@ -757,7 +758,7 @@ dpaa2_hierarchy_commit(struct rte_eth_dev *dev, int clear_on_fail,
 	}

 	LIST_FOREACH(channel_node, &priv->nodes, next) {
-		int wfq_grp = 0, is_wfq_grp = 0, conf[DPNI_MAX_TC];
+		int wfq_grp = 0, is_wfq_grp = 0, conf[priv->nb_tx_queues];
 		struct dpni_tx_priorities_cfg prio_cfg;

 		memset(&prio_cfg, 0, sizeof(prio_cfg));
@@ -767,6 +768,7 @@ dpaa2_hierarchy_commit(struct rte_eth_dev *dev, int clear_on_fail,
 		if (channel_node->level_id != CHANNEL_LEVEL)
 			continue;

+		conf_schedule = false;
 		LIST_FOREACH(leaf_node, &priv->nodes, next) {
 			struct dpaa2_queue *leaf_dpaa2_q;
 			uint8_t leaf_tc_id;
@@ -789,6 +791,7 @@ dpaa2_hierarchy_commit(struct rte_eth_dev *dev, int clear_on_fail,
 			if (leaf_node->parent != channel_node)
 				continue;

+			conf_schedule = true;
 			leaf_dpaa2_q =  (struct dpaa2_queue *)dev->data->tx_queues[leaf_node->id];
 			leaf_tc_id = leaf_dpaa2_q->tc_index;
 			/* Process sibling leaf nodes */
@@ -829,8 +832,8 @@ dpaa2_hierarchy_commit(struct rte_eth_dev *dev, int clear_on_fail,
 						goto out;
 					}
 					is_wfq_grp = 1;
-					conf[temp_leaf_node->id] = 1;
 				}
+				conf[temp_leaf_node->id] = 1;
 			}
 			if (is_wfq_grp) {
 				if (wfq_grp == 0) {
@@ -851,6 +854,9 @@ dpaa2_hierarchy_commit(struct rte_eth_dev *dev, int clear_on_fail,
 			}
 			conf[leaf_node->id] = 1;
 		}
+		if (!conf_schedule)
+			continue;
+
 		if (wfq_grp > 1) {
 			prio_cfg.separate_groups = 1;
 			if (prio_cfg.prio_group_B < prio_cfg.prio_group_A) {
@@ -864,6 +870,16 @@ dpaa2_hierarchy_commit(struct rte_eth_dev *dev, int clear_on_fail,

 		prio_cfg.prio_group_A = 1;
 		prio_cfg.channel_idx = channel_node->channel_id;
+		DPAA2_PMD_DEBUG("########################################");
+		DPAA2_PMD_DEBUG("Channel idx = %d", prio_cfg.channel_idx);
+		for (t = 0; t < DPNI_MAX_TC; t++)
+			DPAA2_PMD_DEBUG("tc = %d mode = %d, delta = %d", t,
+					prio_cfg.tc_sched[t].mode,
+					prio_cfg.tc_sched[t].delta_bandwidth);
+
+		DPAA2_PMD_DEBUG("prioritya = %d, priorityb = %d, separate grps"
+				" = %d", prio_cfg.prio_group_A,
+				prio_cfg.prio_group_B, prio_cfg.separate_groups);
 		ret = dpni_set_tx_priorities(dpni, 0, priv->token, &prio_cfg);
 		if (ret) {
 			ret = -rte_tm_error_set(error, EINVAL,
@@ -871,15 +887,6 @@ dpaa2_hierarchy_commit(struct rte_eth_dev *dev, int clear_on_fail,
 					"Scheduling Failed\n");
 			goto out;
 		}
-		DPAA2_PMD_DEBUG("########################################");
-		DPAA2_PMD_DEBUG("Channel idx = %d", prio_cfg.channel_idx);
-		for (t = 0; t < DPNI_MAX_TC; t++) {
-			DPAA2_PMD_DEBUG("tc = %d mode = %d ", t, prio_cfg.tc_sched[t].mode);
-			DPAA2_PMD_DEBUG("delta = %d", prio_cfg.tc_sched[t].delta_bandwidth);
-		}
-		DPAA2_PMD_DEBUG("prioritya = %d", prio_cfg.prio_group_A);
-		DPAA2_PMD_DEBUG("priorityb = %d", prio_cfg.prio_group_B);
-		DPAA2_PMD_DEBUG("separate grps = %d", prio_cfg.separate_groups);
 	}
 	return 0;

--
2.34.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-12-06 23:26:44.912192917 +0800
+++ 0023-net-dpaa2-fix-memory-corruption-in-TM.patch	2024-12-06 23:26:43.903044828 +0800
@@ -1 +1 @@
-From d77cb0c44cf6b68dc71684bd302fd3138b36e5f1 Mon Sep 17 00:00:00 2001
+From 2069d39f4189a95a38b119191ce0a48c83f1a1d4 Mon Sep 17 00:00:00 2001
@@ -4,0 +5,3 @@
+Cc: Xueming Li <xuemingl at nvidia.com>
+
+[ upstream commit d77cb0c44cf6b68dc71684bd302fd3138b36e5f1 ]
@@ -13 +15,0 @@
-Cc: stable at dpdk.org
@@ -22 +24 @@
-index fb8c384ca4..ab3e355853 100644
+index 3c0f282ec3..c4efdf0af8 100644