[PATCH 1/5] common/cnxk: fix macsec teardown use-after-free

[Aarnav JP]

The idev mcs_list is walked from the mailbox interrupt thread via
roc_idev_mcs_get() and dereferenced in mcs_event_cb_process(), while
the control thread can concurrently free the mcs in roc_mcs_dev_fini().
With no lock on the list, an MCS interrupt during teardown could read
freed memory or corrupt the TAILQ mid-splice.

Add a dedicated idev mcs_lock, held across the lookup+callback in the
interrupt handler, the list insert in roc_mcs_dev_init(), and the
TAILQ_REMOVE in roc_mcs_dev_fini() (which drains any in-flight
interrupt before mcs and sa_port_map are freed). List helpers stay
lock-free to avoid recursive locking.

Fixes: f752780f30dc ("common/cnxk: add ROC MACsec initialization")
Cc: stable at dpdk.org

Signed-off-by: Aarnav JP <ajp at marvell.com>
---
 drivers/common/cnxk/roc_dev.c       | 11 +++++++++--
 drivers/common/cnxk/roc_idev.c      |  1 +
 drivers/common/cnxk/roc_idev_priv.h |  1 +
 drivers/common/cnxk/roc_mcs.c       | 30 +++++++++++++++++++++--------
 4 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index a432fb8710..6d918bf17b 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -669,15 +669,20 @@ static int
 mbox_up_handler_mcs_intr_notify(struct dev *dev, struct mcs_intr_info *info, struct msg_rsp *rsp)
 {
 	struct roc_mcs_event_desc desc = {0};
+	struct idev_cfg *idev = idev_get_cfg();
 	struct roc_mcs *mcs;
 
 	plt_base_dbg("pf:%d/vf:%d msg id 0x%x (%s) from: pf:%d/vf:%d", dev_get_pf(dev->pf_func),
 		     dev_get_vf(dev->pf_func), info->hdr.id, mbox_id2name(info->hdr.id),
 		     dev_get_pf(info->hdr.pcifunc), dev_get_vf(info->hdr.pcifunc));
 
+	if (idev == NULL)
+		goto exit;
+
+	plt_spinlock_lock(&idev->mcs_lock);
 	mcs = roc_idev_mcs_get(info->mcs_id);
 	if (!mcs)
-		goto exit;
+		goto unlock;
 
 	if (info->intr_mask) {
 		switch (info->intr_mask) {
@@ -739,12 +744,14 @@ mbox_up_handler_mcs_intr_notify(struct dev *dev, struct mcs_intr_info *info, str
 			desc.metadata.lmac_id = info->lmac_id;
 			break;
 		default:
-			goto exit;
+			goto unlock;
 		}
 
 		mcs_event_cb_process(mcs, &desc);
 	}
 
+unlock:
+	plt_spinlock_unlock(&idev->mcs_lock);
 exit:
 	rsp->hdr.rc = 0;
 	return 0;
diff --git a/drivers/common/cnxk/roc_idev.c b/drivers/common/cnxk/roc_idev.c
index 6aa5b10ee9..17b99682fd 100644
--- a/drivers/common/cnxk/roc_idev.c
+++ b/drivers/common/cnxk/roc_idev.c
@@ -45,6 +45,7 @@ idev_set_defaults(struct idev_cfg *idev)
 	TAILQ_INIT(&idev->roc_nix_list);
 	plt_spinlock_init(&idev->nix_inl_dev_lock);
 	plt_spinlock_init(&idev->npa_dev_lock);
+	plt_spinlock_init(&idev->mcs_lock);
 	__atomic_store_n(&idev->npa_refcnt, 0, __ATOMIC_RELEASE);
 }
 
diff --git a/drivers/common/cnxk/roc_idev_priv.h b/drivers/common/cnxk/roc_idev_priv.h
index dde555535b..ca47f6948e 100644
--- a/drivers/common/cnxk/roc_idev_priv.h
+++ b/drivers/common/cnxk/roc_idev_priv.h
@@ -45,6 +45,7 @@ struct idev_cfg {
 	struct idev_nix_inl_rx_inj_cfg inl_rx_inj_cfg;
 	plt_spinlock_t nix_inl_dev_lock;
 	plt_spinlock_t npa_dev_lock;
+	plt_spinlock_t mcs_lock;
 	uint8_t dma_cs_offset;
 };
 
diff --git a/drivers/common/cnxk/roc_mcs.c b/drivers/common/cnxk/roc_mcs.c
index 0ae5618c09..1b45f5dad9 100644
--- a/drivers/common/cnxk/roc_mcs.c
+++ b/drivers/common/cnxk/roc_mcs.c
@@ -839,17 +839,24 @@ struct roc_mcs *
 roc_mcs_dev_init(uint8_t mcs_idx)
 {
 	struct mcs_event_cb_list *cb_list;
+	struct idev_cfg *idev;
 	struct roc_mcs *mcs;
 	struct npa_lf *npa;
 
 	if (!(roc_feature_bphy_has_macsec() || roc_feature_nix_has_macsec()))
 		return NULL;
 
-	mcs = roc_idev_mcs_get(mcs_idx);
-	if (mcs) {
-		plt_info("Skipping device, mcs device already probed");
-		mcs->refcount++;
-		return mcs;
+	idev = idev_get_cfg();
+	if (idev) {
+		plt_spinlock_lock(&idev->mcs_lock);
+		mcs = roc_idev_mcs_get(mcs_idx);
+		if (mcs) {
+			plt_info("Skipping device, mcs device already probed");
+			mcs->refcount++;
+			plt_spinlock_unlock(&idev->mcs_lock);
+			return mcs;
+		}
+		plt_spinlock_unlock(&idev->mcs_lock);
 	}
 
 	mcs = plt_zmalloc(sizeof(struct roc_mcs), PLT_CACHE_LINE_SIZE);
@@ -870,8 +877,11 @@ roc_mcs_dev_init(uint8_t mcs_idx)
 	cb_list = (struct mcs_event_cb_list *)roc_mcs_to_mcs_cb_list(mcs);
 	TAILQ_INIT(cb_list);
 
+	idev = idev_get_cfg();
+	plt_spinlock_lock(&idev->mcs_lock);
 	roc_idev_mcs_set(mcs);
 	mcs->refcount++;
+	plt_spinlock_unlock(&idev->mcs_lock);
 
 	return mcs;
 exit:
@@ -882,12 +892,18 @@ roc_mcs_dev_init(uint8_t mcs_idx)
 void
 roc_mcs_dev_fini(struct roc_mcs *mcs)
 {
+	struct idev_cfg *idev = idev_get_cfg();
 	struct mcs_priv *priv;
 	int i;
 
+	plt_spinlock_lock(&idev->mcs_lock);
 	mcs->refcount--;
-	if (mcs->refcount > 0)
+	if (mcs->refcount > 0) {
+		plt_spinlock_unlock(&idev->mcs_lock);
 		return;
+	}
+	roc_idev_mcs_free(mcs);
+	plt_spinlock_unlock(&idev->mcs_lock);
 
 	priv = roc_mcs_to_mcs_priv(mcs);
 
@@ -902,7 +918,5 @@ roc_mcs_dev_fini(struct roc_mcs *mcs)
 
 	plt_free(mcs->sa_port_map);
 
-	roc_idev_mcs_free(mcs);
-
 	plt_free(mcs);
 }
-- 
2.43.0