patch 'net/i40e/base: fix loop bounds' has been queued to stable release 23.11.3

[Xueming Li]

Hi,

FYI, your patch has been queued to stable release 23.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/30/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://git.dpdk.org/dpdk-stable/log/?h=23.11-staging

This queued commit can be viewed at:
https://git.dpdk.org/dpdk-stable/commit/?h=23.11-staging&id=453f75257c416c6fd10b2011fcd463275e017ab4

Thanks.

Xueming Li <xuemingl at nvidia.com>

---
>From 453f75257c416c6fd10b2011fcd463275e017ab4 Mon Sep 17 00:00:00 2001
From: Barbara Skobiej <barbara.skobiej at intel.com>
Date: Mon, 2 Sep 2024 10:54:35 +0100
Subject: [PATCH] net/i40e/base: fix loop bounds
Cc: Xueming Li <xuemingl at nvidia.com>

[ upstream commit 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 ]

An unchecked value used as a loop bound. Add verification if value of
'next_to_clean' variable is greater than 2^10 (next_to_clean is 10 bits).

Also, refactored loop so that it reads the head value only once, and also
checks if head is invalid.

Fixes: 8db9e2a1b232 ("i40e: base driver")

Signed-off-by: Barbara Skobiej <barbara.skobiej at intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/i40e/base/i40e_adminq.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/net/i40e/base/i40e_adminq.c b/drivers/net/i40e/base/i40e_adminq.c
index 27c82d9b44..cd3b0f2e45 100644
--- a/drivers/net/i40e/base/i40e_adminq.c
+++ b/drivers/net/i40e/base/i40e_adminq.c
@@ -791,12 +791,26 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
 	u16 ntc = asq->next_to_clean;
 	struct i40e_aq_desc desc_cb;
 	struct i40e_aq_desc *desc;
+	u32 head = 0;
+
+	if (ntc >= (1 << 10))
+		goto clean_asq_exit;

 	desc = I40E_ADMINQ_DESC(*asq, ntc);
 	details = I40E_ADMINQ_DETAILS(*asq, ntc);
-	while (rd32(hw, hw->aq.asq.head) != ntc) {
+	while (true) {
+		head = rd32(hw, hw->aq.asq.head);
+
+		if (head >= asq->count) {
+			i40e_debug(hw, I40E_DEBUG_AQ_COMMAND, "Read head value is improper\n");
+			return 0;
+		}
+
+		if (head == ntc)
+			break;
+
 		i40e_debug(hw, I40E_DEBUG_AQ_COMMAND,
-			   "ntc %d head %d.\n", ntc, rd32(hw, hw->aq.asq.head));
+			   "ntc %d head %d.\n", ntc, head);

 		if (details->callback) {
 			I40E_ADMINQ_CALLBACK cb_func =
@@ -816,6 +830,7 @@ u16 i40e_clean_asq(struct i40e_hw *hw)

 	asq->next_to_clean = ntc;

+clean_asq_exit:
 	return I40E_DESC_UNUSED(asq);
 }

--
2.34.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-11-11 14:23:08.369502474 +0800
+++ 0067-net-i40e-base-fix-loop-bounds.patch	2024-11-11 14:23:05.172192839 +0800
@@ -1 +1 @@
-From 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 Mon Sep 17 00:00:00 2001
+From 453f75257c416c6fd10b2011fcd463275e017ab4 Mon Sep 17 00:00:00 2001
@@ -4,0 +5,3 @@
+Cc: Xueming Li <xuemingl at nvidia.com>
+
+[ upstream commit 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 ]
@@ -13 +15,0 @@
-Cc: stable at dpdk.org
@@ -23 +25 @@
-index b670250180..350288269b 100644
+index 27c82d9b44..cd3b0f2e45 100644
@@ -26 +28 @@
-@@ -745,12 +745,26 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
+@@ -791,12 +791,26 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
@@ -55 +57 @@
-@@ -770,6 +784,7 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
+@@ -816,6 +830,7 @@ u16 i40e_clean_asq(struct i40e_hw *hw)