patch 'net/i40e/base: fix loop bounds' has been queued to stable release 21.11.9

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 21.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/02/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/1a38fc74c173a730b557cd4bad8691f3387573db

Thanks.

Kevin

---
>From 1a38fc74c173a730b557cd4bad8691f3387573db Mon Sep 17 00:00:00 2001
From: Barbara Skobiej <barbara.skobiej at intel.com>
Date: Mon, 2 Sep 2024 10:54:35 +0100
Subject: [PATCH] net/i40e/base: fix loop bounds

[ upstream commit 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 ]

An unchecked value used as a loop bound. Add verification if value of
'next_to_clean' variable is greater than 2^10 (next_to_clean is 10 bits).

Also, refactored loop so that it reads the head value only once, and also
checks if head is invalid.

Fixes: 8db9e2a1b232 ("i40e: base driver")

Signed-off-by: Barbara Skobiej <barbara.skobiej at intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/i40e/base/i40e_adminq.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/net/i40e/base/i40e_adminq.c b/drivers/net/i40e/base/i40e_adminq.c
index 27c82d9b44..cd3b0f2e45 100644
--- a/drivers/net/i40e/base/i40e_adminq.c
+++ b/drivers/net/i40e/base/i40e_adminq.c
@@ -792,10 +792,24 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
 	struct i40e_aq_desc desc_cb;
 	struct i40e_aq_desc *desc;
+	u32 head = 0;
+
+	if (ntc >= (1 << 10))
+		goto clean_asq_exit;
 
 	desc = I40E_ADMINQ_DESC(*asq, ntc);
 	details = I40E_ADMINQ_DETAILS(*asq, ntc);
-	while (rd32(hw, hw->aq.asq.head) != ntc) {
+	while (true) {
+		head = rd32(hw, hw->aq.asq.head);
+
+		if (head >= asq->count) {
+			i40e_debug(hw, I40E_DEBUG_AQ_COMMAND, "Read head value is improper\n");
+			return 0;
+		}
+
+		if (head == ntc)
+			break;
+
 		i40e_debug(hw, I40E_DEBUG_AQ_COMMAND,
-			   "ntc %d head %d.\n", ntc, rd32(hw, hw->aq.asq.head));
+			   "ntc %d head %d.\n", ntc, head);
 
 		if (details->callback) {
@@ -817,4 +831,5 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
 	asq->next_to_clean = ntc;
 
+clean_asq_exit:
 	return I40E_DESC_UNUSED(asq);
 }
-- 
2.47.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-11-27 17:17:39.490647542 +0000
+++ 0038-net-i40e-base-fix-loop-bounds.patch	2024-11-27 17:17:38.204269264 +0000
@@ -1 +1 @@
-From 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 Mon Sep 17 00:00:00 2001
+From 1a38fc74c173a730b557cd4bad8691f3387573db Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3e61fe48412f46daa66f7ccc8f03b1e7620d0b64 ]
+
@@ -13 +14,0 @@
-Cc: stable at dpdk.org
@@ -23 +24 @@
-index b670250180..350288269b 100644
+index 27c82d9b44..cd3b0f2e45 100644
@@ -26 +27 @@
-@@ -746,10 +746,24 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
+@@ -792,10 +792,24 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
@@ -53 +54 @@
-@@ -771,4 +785,5 @@ u16 i40e_clean_asq(struct i40e_hw *hw)
+@@ -817,4 +831,5 @@ u16 i40e_clean_asq(struct i40e_hw *hw)