patch 'net/mlx5: fix crash on counter pool destroy' has been queued to stable release 23.11.2

[Xueming Li]

Hi,

FYI, your patch has been queued to stable release 23.11.2

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/14/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://git.dpdk.org/dpdk-stable/log/?h=23.11-staging

This queued commit can be viewed at:
https://git.dpdk.org/dpdk-stable/commit/?h=23.11-staging&id=160e8f583bea1ed2de9bc8d5081b98633596b53b

Thanks.

Xueming Li <xuemingl at nvidia.com>

---
>From 160e8f583bea1ed2de9bc8d5081b98633596b53b Mon Sep 17 00:00:00 2001
From: Maayan Kashani <mkashani at nvidia.com>
Date: Sun, 9 Jun 2024 14:01:02 +0300
Subject: [PATCH] net/mlx5: fix crash on counter pool destroy
Cc: Xueming Li <xuemingl at nvidia.com>

[ upstream commit 3331d59551cdecd2db3a2064a7d6e4bf9396b849 ]

If the counter pool was not added to list,
and an error state was reached,
on attempt to destroy the counter pool,
segmentation fault was received during list remove action.

Added a check to verify the list is not empty before trying to
remove the cpool from the list.

Invalid state, leading to segfault,
can also be reached in the following scenario:
1.	mlx5_hws_cnt_pool_init() does a zmalloc and initializes most
        of the fields of cpool, but does not initialize the next field.
2.	mlx5_hws_cnt_pool_dcs_alloc() attempts to bulk allocate flow counters.
	If this fails, we skip straight to 4.
	In HW, this can fail simply if FW doesn't support bulk flow
	counter allocation.
3.	Right before the goto error, we insert the cpool to the hws_cpool_list.
	This is where the next field is initialized.
4.	mlx5_hws_cnt_pool_destroy() assumes the cpool's next field
	is initialized and SEGVs if not.

So, added a guard against cases where the entry was uninitialized
(checking le_prev field is not NULL).

Fixes: 6ac2104ac125 ("net/mlx5: fix counter query during port close")

Signed-off-by: Maayan Kashani <mkashani at nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski at nvidia.com>
---
 drivers/net/mlx5/mlx5_hws_cnt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_hws_cnt.c b/drivers/net/mlx5/mlx5_hws_cnt.c
index c31f2f380b..41edd19bb8 100644
--- a/drivers/net/mlx5/mlx5_hws_cnt.c
+++ b/drivers/net/mlx5/mlx5_hws_cnt.c
@@ -719,7 +719,9 @@ mlx5_hws_cnt_pool_destroy(struct mlx5_dev_ctx_shared *sh,
 	 * Maybe blocked for at most 200ms here.
 	 */
 	rte_spinlock_lock(&sh->cpool_lock);
-	LIST_REMOVE(cpool, next);
+	/* Try to remove cpool before it was added to list caused segfault. */
+	if (!LIST_EMPTY(&sh->hws_cpool_list) && cpool->next.le_prev)
+		LIST_REMOVE(cpool, next);
 	rte_spinlock_unlock(&sh->cpool_lock);
 	if (cpool->cfg.host_cpool == NULL) {
 		if (--sh->cnt_svc->refcnt == 0)
-- 
2.34.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-07-12 18:40:18.361890816 +0800
+++ 0095-net-mlx5-fix-crash-on-counter-pool-destroy.patch	2024-07-12 18:40:14.336594199 +0800
@@ -1 +1 @@
-From 3331d59551cdecd2db3a2064a7d6e4bf9396b849 Mon Sep 17 00:00:00 2001
+From 160e8f583bea1ed2de9bc8d5081b98633596b53b Mon Sep 17 00:00:00 2001
@@ -4,0 +5,3 @@
+Cc: Xueming Li <xuemingl at nvidia.com>
+
+[ upstream commit 3331d59551cdecd2db3a2064a7d6e4bf9396b849 ]
@@ -31 +33,0 @@
-Cc: stable at dpdk.org
@@ -40 +42 @@
-index 36d422bdfa..a46a4bd94e 100644
+index c31f2f380b..41edd19bb8 100644
@@ -43 +45 @@
-@@ -718,7 +718,9 @@ mlx5_hws_cnt_pool_destroy(struct mlx5_dev_ctx_shared *sh,
+@@ -719,7 +719,9 @@ mlx5_hws_cnt_pool_destroy(struct mlx5_dev_ctx_shared *sh,