patch 'net/dpaa2: fix MAC stats DMA alloc per xstats call' has been queued to stable release 25.11.1

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 04/03/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/4db8c1efb7d8b091f59f4470afd7096eb7a1c1f3

Thanks.

Kevin

---
>From 4db8c1efb7d8b091f59f4470afd7096eb7a1c1f3 Mon Sep 17 00:00:00 2001
From: Maxime Leroy <maxime at leroys.fr>
Date: Wed, 25 Mar 2026 21:45:41 +0100
Subject: [PATCH] net/dpaa2: fix MAC stats DMA alloc per xstats call

[ upstream commit d910d1bbc23efab3e420bd68b312ef48e017889e ]

dpaa2_dev_mac_setup_stats() allocates and frees DMA buffers on every
xstats_get() call. This is wasteful and not thread-safe: concurrent
callers can overwrite priv pointers, leading to use-after-free. It
also does not check for allocation failure before passing IOVAs to
the MC firmware.

Move the DMA buffer allocation to dpaa2_dev_init() (only when MC
version supports MAC stats) and free them in dpaa2_dev_close(). In
xstats_get(), just check if the buffers were allocated.

Not tested, found by code review.

Fixes: d1cdef2ab592 ("net/dpaa2: add dpmac counters in xstats")

Reported-by: Stephen Hemminger <stephen at networkplumber.org>
Signed-off-by: Maxime Leroy <maxime at leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal at nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 65 +++++++++++++++-----------------
 1 file changed, 30 insertions(+), 35 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 965af37feb..a8374e717b 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -1554,4 +1554,9 @@ dpaa2_dev_close(struct rte_eth_dev *dev)
 	rte_free(priv->extract.qos_extract_param);
 
+	rte_free(priv->cnt_idx_dma_mem);
+	rte_free(priv->cnt_values_dma_mem);
+	priv->cnt_idx_dma_mem = NULL;
+	priv->cnt_values_dma_mem = NULL;
+
 	DPAA2_PMD_INFO("%s: netdev deleted", dev->data->name);
 	return 0;
@@ -1909,5 +1914,4 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
 	struct dpaa2_dev_priv *priv = dev->data->dev_private;
 	union dpni_statistics value[13] = {};
-	struct mc_version mc_ver_info = {0};
 	struct dpni_rx_tc_policing_cfg cfg;
 	uint8_t page_id, stats_id;
@@ -1980,42 +1984,22 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
 	}
 
-	if (mc_get_version(dpni, CMD_PRI_LOW, &mc_ver_info))
-		DPAA2_PMD_WARN("Unable to obtain MC version");
-
-	/* mac_statistics supported on MC version > 10.39.0 */
-	if (mc_ver_info.major >= MC_VER_MAJOR &&
-	    mc_ver_info.minor >= MC_VER_MINOR &&
-	    mc_ver_info.revision > 0) {
-		dpaa2_dev_mac_setup_stats(dev);
-		retcode = dpni_get_mac_statistics(dpni, CMD_PRI_LOW, priv->token,
-						  priv->cnt_idx_iova,
-						  priv->cnt_values_iova,
-						  DPAA2_MAC_NUM_STATS);
-		if (retcode) {
-			while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
-				xstats[i].id = i;
-				xstats[i].value = 0;
-				i++;
-			}
-		}
-		if (!retcode) {
-			cnt_values = priv->cnt_values_dma_mem;
-			while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
-				/* mac counters value */
-				xstats[i].id = i;
-				xstats[i].value = rte_le_to_cpu_64(*cnt_values++);
-				i++;
-			}
-		}
-		rte_free(priv->cnt_values_dma_mem);
-		rte_free(priv->cnt_idx_dma_mem);
-		priv->cnt_idx_dma_mem = NULL;
-		priv->cnt_values_dma_mem = NULL;
-	} else {
+	if (priv->cnt_idx_dma_mem &&
+	    !dpni_get_mac_statistics(dpni, CMD_PRI_LOW, priv->token,
+				    priv->cnt_idx_iova,
+				    priv->cnt_values_iova,
+				    DPAA2_MAC_NUM_STATS)) {
+		cnt_values = priv->cnt_values_dma_mem;
 		while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
 			xstats[i].id = i;
-			xstats[i].value = 0;
+			xstats[i].value = rte_le_to_cpu_64(*cnt_values++);
 			i++;
 		}
+		return i;
+	}
+
+	while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
+		xstats[i].id = i;
+		xstats[i].value = 0;
+		i++;
 	}
 
@@ -3159,4 +3143,15 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 	priv->speed_capa = dpaa2_dev_get_speed_capability(eth_dev);
 
+	/* mac_statistics supported on MC version > 10.39.0 */
+	{
+		struct mc_version mc_ver_info = {0};
+
+		if (!mc_get_version(dpni_dev, CMD_PRI_LOW, &mc_ver_info) &&
+		    mc_ver_info.major >= MC_VER_MAJOR &&
+		    mc_ver_info.minor >= MC_VER_MINOR &&
+		    mc_ver_info.revision > 0)
+			dpaa2_dev_mac_setup_stats(eth_dev);
+	}
+
 	return 0;
 init_err:
-- 
2.53.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-04-01 12:56:52.494216677 +0100
+++ 0017-net-dpaa2-fix-MAC-stats-DMA-alloc-per-xstats-call.patch	2026-04-01 12:56:52.019524076 +0100
@@ -1 +1 @@
-From d910d1bbc23efab3e420bd68b312ef48e017889e Mon Sep 17 00:00:00 2001
+From 4db8c1efb7d8b091f59f4470afd7096eb7a1c1f3 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit d910d1bbc23efab3e420bd68b312ef48e017889e ]
+
@@ -19 +20,0 @@
-Cc: stable at dpdk.org
@@ -29 +30 @@
-index 18d8bf5444..9c384f6430 100644
+index 965af37feb..a8374e717b 100644
@@ -32 +33 @@
-@@ -1552,4 +1552,9 @@ dpaa2_dev_close(struct rte_eth_dev *dev)
+@@ -1554,4 +1554,9 @@ dpaa2_dev_close(struct rte_eth_dev *dev)
@@ -42 +43 @@
-@@ -1907,5 +1912,4 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
+@@ -1909,5 +1914,4 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
@@ -48 +49 @@
-@@ -1978,42 +1982,22 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
+@@ -1980,42 +1984,22 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
@@ -105 +106 @@
-@@ -3157,4 +3141,15 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
+@@ -3159,4 +3143,15 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)