patch 'ethdev: fix overflow in descriptor count' has been queued to stable release 21.11.9

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 21.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/02/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/9064f0c3785e1915461a732e9b3c907939ba6254

Thanks.

Kevin

---
>From 9064f0c3785e1915461a732e9b3c907939ba6254 Mon Sep 17 00:00:00 2001
From: Niall Meade <niall.meade at intel.com>
Date: Mon, 30 Sep 2024 13:40:02 +0000
Subject: [PATCH] ethdev: fix overflow in descriptor count

[ upstream commit 30efe60d3a37896567b660229ef6a04c5526f6db ]

Addressed a specific overflow issue in the eth_dev_adjust_nb_desc()
function where the uint16_t variable nb_desc would overflow when its
value was greater than (2^16 - nb_align). This overflow caused nb_desc
to incorrectly wrap around between 0 and nb_align-1, leading to the
function setting nb_desc to nb_min instead of the expected nb_max.

To give an example, let nb_desc=UINT16_MAX, nb_align=32, nb_max=4096 and
nb_min=64. RTE_ALIGN_CEIL(nb_desc, nb_align) calls
RTE_ALIGN_FLOOR(nb_desc + nb_align - 1, nb_align). This results in an
overflow of nb_desc, leading to nb_desc being set to 30 and then 0 when
the macros return. As a result of this, nb_desc is then set to nb_min
later on.

The resolution involves upcasting nb_desc to a uint32_t before the
RTE_ALIGN_CEIL macro is applied. This change ensures that the subsequent
call to RTE_ALIGN_FLOOR(nb_desc + (nb_align - 1), nb_align) does not
result in an overflow, as it would when nb_desc is a uint16_t. By using
a uint32_t for these operations, the correct behavior is maintained
without the risk of overflow.

Fixes: 0f67fc3baeb9 ("ethdev: add function to adjust number of descriptors")

Signed-off-by: Niall Meade <niall.meade at intel.com>
Reviewed-by: Ferruh Yigit <ferruh.yigit at amd.com>
---
 .mailmap                |  1 +
 lib/ethdev/rte_ethdev.c | 12 +++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.mailmap b/.mailmap
index 5d6a7701d7..296e6528b6 100644
--- a/.mailmap
+++ b/.mailmap
@@ -989,4 +989,5 @@ Nemanja Marjanovic <nemanja.marjanovic at intel.com>
 Netanel Belgazal <netanel at amazon.com>
 Netanel Gonen <netanelg at mellanox.com>
+Niall Meade <niall.meade at intel.com>
 Niall Power <niall.power at intel.com>
 Nick Connolly <nick.connolly at arm.com> <nick.connolly at mayadata.io>
diff --git a/lib/ethdev/rte_ethdev.c b/lib/ethdev/rte_ethdev.c
index b246f7836a..1b2e1750c9 100644
--- a/lib/ethdev/rte_ethdev.c
+++ b/lib/ethdev/rte_ethdev.c
@@ -5858,11 +5858,17 @@ eth_dev_adjust_nb_desc(uint16_t *nb_desc,
 		const struct rte_eth_desc_lim *desc_lim)
 {
+	/* Upcast to uint32 to avoid potential overflow with RTE_ALIGN_CEIL(). */
+	uint32_t nb_desc_32 = (uint32_t)*nb_desc;
+
 	if (desc_lim->nb_align != 0)
-		*nb_desc = RTE_ALIGN_CEIL(*nb_desc, desc_lim->nb_align);
+		nb_desc_32 = RTE_ALIGN_CEIL(nb_desc_32, desc_lim->nb_align);
 
 	if (desc_lim->nb_max != 0)
-		*nb_desc = RTE_MIN(*nb_desc, desc_lim->nb_max);
+		nb_desc_32 = RTE_MIN(nb_desc_32, desc_lim->nb_max);
 
-	*nb_desc = RTE_MAX(*nb_desc, desc_lim->nb_min);
+	nb_desc_32 = RTE_MAX(nb_desc_32, desc_lim->nb_min);
+
+	/* Assign clipped u32 back to u16. */
+	*nb_desc = (uint16_t)nb_desc_32;
 }
 
-- 
2.47.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-11-27 17:17:39.788159964 +0000
+++ 0048-ethdev-fix-overflow-in-descriptor-count.patch	2024-11-27 17:17:38.222269357 +0000
@@ -1 +1 @@
-From 30efe60d3a37896567b660229ef6a04c5526f6db Mon Sep 17 00:00:00 2001
+From 9064f0c3785e1915461a732e9b3c907939ba6254 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 30efe60d3a37896567b660229ef6a04c5526f6db ]
+
@@ -27 +28,0 @@
-Cc: stable at dpdk.org
@@ -37 +38 @@
-index d49838320e..6e72362ebc 100644
+index 5d6a7701d7..296e6528b6 100644
@@ -40 +41 @@
-@@ -1071,4 +1071,5 @@ Nemanja Marjanovic <nemanja.marjanovic at intel.com>
+@@ -989,4 +989,5 @@ Nemanja Marjanovic <nemanja.marjanovic at intel.com>
@@ -45 +46 @@
- Nicholas Pratte <npratte at iol.unh.edu>
+ Nick Connolly <nick.connolly at arm.com> <nick.connolly at mayadata.io>
@@ -47 +48 @@
-index a1f7efa913..84ee7588fc 100644
+index b246f7836a..1b2e1750c9 100644
@@ -50 +51 @@
-@@ -6668,11 +6668,17 @@ eth_dev_adjust_nb_desc(uint16_t *nb_desc,
+@@ -5858,11 +5858,17 @@ eth_dev_adjust_nb_desc(uint16_t *nb_desc,