patch 'net/dpaa2: fix integer overflow in CCSR region mapping' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/83942bc4d39b741a3a709985a167911e27db04ff

Thanks.

Luca Boccassi

---
>From 83942bc4d39b741a3a709985a167911e27db04ff Mon Sep 17 00:00:00 2001
From: Hemant Agrawal <hemant.agrawal at nxp.com>
Date: Tue, 20 Oct 2026 20:18:32 +0530
Subject: [PATCH] net/dpaa2: fix integer overflow in CCSR region mapping

[ upstream commit 76594ee1d104260ca663cbec8ed27cda92715b59 ]

In lsx_ccsr_map_region(), PAGE_SIZE is defined as
sysconf(_SC_PAGESIZE), which returns a signed long and may be
negative on error. The value was used directly in size_t
comparisons and mmap() length calculations, leading to an
integer overflow (Coverity CID 49765682).

The old code also computed the mapping length without taking
the address offset within the page into account. As a result,
regions crossing a page boundary might not be fully mapped.
The mapping size must cover the entire range from the
page-aligned start address through offset + len.

Fix by validating the page size returned by sysconf(),
deriving the page mask from the validated value, and using
RTE_ALIGN_CEIL(offset + len, page_size) to calculate the
mapping length.

Coverity issue: 49765682
Fixes: f023d059769f ("net/dpaa2: support recycle loopback port")

Signed-off-by: Hemant Agrawal <hemant.agrawal at nxp.com>
---
 drivers/net/dpaa2/dpaa2_recycle.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_recycle.c b/drivers/net/dpaa2/dpaa2_recycle.c
index f68653e0f44..238bdaaff1a 100644
--- a/drivers/net/dpaa2/dpaa2_recycle.c
+++ b/drivers/net/dpaa2/dpaa2_recycle.c
@@ -178,6 +178,9 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)
 	void *tmp;
 	uint64_t start;
 	uint64_t offset;
+	uint64_t page_mask;
+	long page_size;
+	size_t map_len;
 
 	fd = open("/dev/mem", O_RDWR);
 	if (fd < 0) {
@@ -185,20 +188,24 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)
 		return NULL;
 	}
 
-	start = addr & PAGE_MASK;
+	page_size = sysconf(_SC_PAGESIZE);
+	if (page_size <= 0) {
+		close(fd);
+		return NULL;
+	}
+	page_mask = ~((uint64_t)page_size - 1);
+	start = addr & page_mask;
 	offset = addr - start;
-	len = len & PAGE_MASK;
-	if (len < (size_t)PAGE_SIZE)
-		len = PAGE_SIZE;
+	map_len = RTE_ALIGN_CEIL(offset + len, (size_t)page_size);
 
-	tmp = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, start);
+	tmp = mmap(NULL, map_len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, start);
 
 	close(fd);
 
-	if (tmp != MAP_FAILED)
-		return (uint8_t *)tmp + offset;
-	else
+	if (tmp == MAP_FAILED)
 		return NULL;
+
+	return (uint8_t *)tmp + offset;
 }
 
 static const uint8_t ls_sd1_prot_idx_map[] = {
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:48.482464160 +0000
+++ 0093-net-dpaa2-fix-integer-overflow-in-CCSR-region-mappin.patch	2026-11-05 16:42:45.025063894 +0000
@@ -1 +1 @@
-From 76594ee1d104260ca663cbec8ed27cda92715b59 Mon Sep 17 00:00:00 2001
+From 83942bc4d39b741a3a709985a167911e27db04ff Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 76594ee1d104260ca663cbec8ed27cda92715b59 ]
+
@@ -25 +26,0 @@
-Cc: stable at dpdk.org
@@ -33 +34 @@
-index f78d12362e..9b6ae3f515 100644
+index f68653e0f44..238bdaaff1a 100644
@@ -36 +37 @@
-@@ -176,6 +176,9 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)
+@@ -178,6 +178,9 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)
@@ -46 +47 @@
-@@ -183,20 +186,24 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)
+@@ -185,20 +188,24 @@ static void *lsx_ccsr_map_region(uint64_t addr, size_t len)