patch 'event/cnxk: fix out-of-bounds access' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/07c3e24ebc54e14ad9722368f8b4d2d4c0c8403a

Thanks.

Luca Boccassi

---
>From 07c3e24ebc54e14ad9722368f8b4d2d4c0c8403a Mon Sep 17 00:00:00 2001
From: Pavan Nikhilesh <pbhagavatula at marvell.com>
Date: Wed, 9 Sep 2026 07:30:11 +0530
Subject: [PATCH] event/cnxk: fix out-of-bounds access

[ upstream commit e80411aecd4b2182894101358fb5ee9da127e380 ]

The devargs parsing helpers wrote to the parameter structure for as
long as tokens remained, so supplying more tokens than expected
overflowed the fixed-size structures. Bound each loop to the
structure size and reject input that contains extra tokens.

Likewise, cnxk_sso_xstats_get() and cnxk_sso_xstats_reset() indexed
the xstats array with caller-supplied IDs that were never validated,
so out-of-range IDs could access past the array. Skip any ID that
falls outside the valid range.

cnxk_tim_add_entry_tmo_hwwqe() used cnt as a count of LMT lines, not
timers, when computing the remainder, so nb_timers >= 8 wrote past
the LMT line. Convert cnt to a timer count first.

Fixes: 38c2e3240ba8 ("event/cnxk: add option to control SSO HWGRP QoS")
Fixes: 20345cbda6d3 ("event/cnxk: support WQE stashing")
Fixes: b5a52c9d97e2 ("event/cnxk: add event port and queue xstats")
Fixes: 8a3d58c189fd ("event/cnxk: add option to control timer adapters")
Fixes: 822d4ef519f6 ("event/cnxk: add CN20K timer adapter")

Signed-off-by: Pavan Nikhilesh <pbhagavatula at marvell.com>
---
 drivers/event/cnxk/cnxk_eventdev.c       |  8 +--
 drivers/event/cnxk/cnxk_eventdev_stats.c | 64 +++++++++++++++++-------
 drivers/event/cnxk/cnxk_tim_evdev.c      |  4 +-
 drivers/event/cnxk/cnxk_tim_worker.h     |  1 +
 4 files changed, 52 insertions(+), 25 deletions(-)

diff --git a/drivers/event/cnxk/cnxk_eventdev.c b/drivers/event/cnxk/cnxk_eventdev.c
index 4aa16f90269..1fb4466161a 100644
--- a/drivers/event/cnxk/cnxk_eventdev.c
+++ b/drivers/event/cnxk/cnxk_eventdev.c
@@ -488,13 +488,13 @@ parse_queue_param(char *value, void *opaque)
 	if (!strlen(value))
 		return;
 
-	while (tok != NULL) {
+	while (tok != NULL && val < (&queue_qos.iaq_prcnt + 1)) {
 		*val = atoi(tok);
 		tok = strtok(NULL, "-");
 		val++;
 	}
 
-	if (val != (&queue_qos.iaq_prcnt + 1)) {
+	if (tok != NULL || val != (&queue_qos.iaq_prcnt + 1)) {
 		plt_err("Invalid QoS parameter expected [Qx-TAQ-IAQ]");
 		return;
 	}
@@ -525,13 +525,13 @@ parse_stash_param(char *value, void *opaque)
 		return;
 
 	val = (uint16_t *)&queue_stash;
-	while (tok != NULL) {
+	while (tok != NULL && val < (&queue_stash.stash_length + 1)) {
 		*val = atoi(tok);
 		tok = strtok(NULL, "|");
 		val++;
 	}
 
-	if (val != (&queue_stash.stash_length + 1)) {
+	if (tok != NULL || val != (&queue_stash.stash_length + 1)) {
 		plt_err("Invalid QoS parameter expected [Qx|stash_offset|stash_length]");
 		return;
 	}
diff --git a/drivers/event/cnxk/cnxk_eventdev_stats.c b/drivers/event/cnxk/cnxk_eventdev_stats.c
index 6dea91aedf3..d88e6130b9d 100644
--- a/drivers/event/cnxk/cnxk_eventdev_stats.c
+++ b/drivers/event/cnxk/cnxk_eventdev_stats.c
@@ -157,6 +157,8 @@ cnxk_sso_xstats_get(const struct rte_eventdev *event_dev,
 	};
 
 	for (i = 0; i < n && i < xstats_mode_count; i++) {
+		if (ids[i] < start_offset || (ids[i] - start_offset) >= xstats_mode_count)
+			goto invalid_value;
 		xstat = &xstats[ids[i] - start_offset];
 		value = *(uint64_t *)((char *)rsp + xstat->offset);
 		value = (value >> xstat->shift) & xstat->mask;
@@ -181,6 +183,7 @@ cnxk_sso_xstats_reset(struct rte_eventdev *event_dev,
 	struct cnxk_sso_xstats_name *xstat;
 	struct roc_sso_hws_stats hws_stats;
 	uint32_t xstats_mode_count = 0;
+	int16_t first_id, last_id, id;
 	uint32_t start_offset = 0;
 	unsigned int i;
 	uint64_t value;
@@ -191,44 +194,67 @@ cnxk_sso_xstats_reset(struct rte_eventdev *event_dev,
 	case RTE_EVENT_DEV_XSTATS_DEVICE:
 		return 0;
 	case RTE_EVENT_DEV_XSTATS_PORT:
-		if (queue_port_id >= (signed int)dev->nb_event_ports)
+		if (queue_port_id >= (int16_t)dev->nb_event_ports)
 			goto invalid_value;
 
 		xstats_mode_count = CNXK_SSO_NUM_HWS_XSTATS;
 		xstats = sso_hws_xstats;
-		rc = roc_sso_hws_stats_get(&dev->sso, queue_port_id,
-					   &hws_stats);
-		if (rc < 0)
-			goto invalid_value;
-		rsp = &hws_stats;
+		/* Negative id requests a reset of all ports. */
+		first_id = (queue_port_id < 0) ? 0 : queue_port_id;
+		last_id = (queue_port_id < 0) ? (int16_t)dev->nb_event_ports - 1 : queue_port_id;
 		break;
 	case RTE_EVENT_DEV_XSTATS_QUEUE:
-		if (queue_port_id >= (signed int)dev->nb_event_queues)
+		if (queue_port_id >= (int16_t)dev->nb_event_queues)
 			goto invalid_value;
 
 		xstats_mode_count = CNXK_SSO_NUM_GRP_XSTATS;
 		start_offset = CNXK_SSO_NUM_HWS_XSTATS;
 		xstats = sso_hwgrp_xstats;
-
-		rc = roc_sso_hwgrp_stats_get(&dev->sso, queue_port_id,
-					     &hwgrp_stats);
-		if (rc < 0)
-			goto invalid_value;
-		rsp = &hwgrp_stats;
+		/* Negative id requests a reset of all queues. */
+		first_id = (queue_port_id < 0) ? 0 : queue_port_id;
+		last_id = (queue_port_id < 0) ? (int16_t)dev->nb_event_queues - 1 : queue_port_id;
 		break;
 	default:
 		plt_err("Invalid mode received");
 		goto invalid_value;
 	};
 
-	for (i = 0; i < n && i < xstats_mode_count; i++) {
-		xstat = &xstats[ids[i] - start_offset];
-		value = *(uint64_t *)((char *)rsp + xstat->offset);
-		value = (value >> xstat->shift) & xstat->mask;
+	for (id = first_id; id <= last_id; id++) {
+		if (mode == RTE_EVENT_DEV_XSTATS_PORT) {
+			rc = roc_sso_hws_stats_get(&dev->sso, id, &hws_stats);
+			if (rc < 0)
+				goto invalid_value;
+			rsp = &hws_stats;
+		} else {
+			rc = roc_sso_hwgrp_stats_get(&dev->sso, id, &hwgrp_stats);
+			if (rc < 0)
+				goto invalid_value;
+			rsp = &hwgrp_stats;
+		}
 
-		xstat->reset_snap[queue_port_id] = value;
+		if (ids == NULL) {
+			for (i = 0; i < xstats_mode_count; i++) {
+				xstat = &xstats[i];
+				value = *(uint64_t *)((char *)rsp + xstat->offset);
+				value = (value >> xstat->shift) & xstat->mask;
+
+				xstat->reset_snap[id] = value;
+			}
+			continue;
+		}
+
+		for (i = 0; i < n; i++) {
+			if (ids[i] < start_offset || (ids[i] - start_offset) >= xstats_mode_count)
+				goto invalid_value;
+			xstat = &xstats[ids[i] - start_offset];
+			value = *(uint64_t *)((char *)rsp + xstat->offset);
+			value = (value >> xstat->shift) & xstat->mask;
+
+			xstat->reset_snap[id] = value;
+		}
 	}
-	return i;
+
+	return 0;
 invalid_value:
 	return -EINVAL;
 }
diff --git a/drivers/event/cnxk/cnxk_tim_evdev.c b/drivers/event/cnxk/cnxk_tim_evdev.c
index 8cdb8a72dd3..bc1489d9854 100644
--- a/drivers/event/cnxk/cnxk_tim_evdev.c
+++ b/drivers/event/cnxk/cnxk_tim_evdev.c
@@ -464,13 +464,13 @@ cnxk_tim_parse_ring_param(char *value, void *opaque)
 	if (!strlen(value))
 		return;
 
-	while (tok != NULL) {
+	while (tok != NULL && val < (&ring_ctl.enable_stats + 1)) {
 		*val = atoi(tok);
 		tok = strtok(NULL, "-");
 		val++;
 	}
 
-	if (val != (&ring_ctl.enable_stats + 1)) {
+	if (tok != NULL || val != (&ring_ctl.enable_stats + 1)) {
 		plt_err("Invalid ring param expected [ring-chunk_sz-disable_npa-enable_stats]");
 		return;
 	}
diff --git a/drivers/event/cnxk/cnxk_tim_worker.h b/drivers/event/cnxk/cnxk_tim_worker.h
index 09f84091abb..a3305386181 100644
--- a/drivers/event/cnxk/cnxk_tim_worker.h
+++ b/drivers/event/cnxk/cnxk_tim_worker.h
@@ -725,6 +725,7 @@ cnxk_tim_add_entry_tmo_hwwqe(struct cnxk_tim_ring *const tim_ring,
 		}
 	}
 
+	cnt *= CNXK_TIM_ENT_PER_LMT;
 	/* SIZEM1 is 0 */
 	pa = (tim_ring->tbase & ~0xFF) + TIM_LF_SCHED_TIMER0;
 	pa |= (uint64_t)((nb_timers - cnt) << 4);
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:54.051656517 +0000
+++ 0007-event-cnxk-fix-out-of-bounds-access.patch	2026-10-27 11:43:53.498058954 +0000
@@ -1 +1 @@
-From e80411aecd4b2182894101358fb5ee9da127e380 Mon Sep 17 00:00:00 2001
+From 07c3e24ebc54e14ad9722368f8b4d2d4c0c8403a Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit e80411aecd4b2182894101358fb5ee9da127e380 ]
+
@@ -25 +26,0 @@
-Cc: stable at dpdk.org
@@ -36 +37 @@
-index 41079af2a9..e3a3134264 100644
+index 4aa16f90269..1fb4466161a 100644
@@ -72 +73 @@
-index 6dea91aedf..d88e6130b9 100644
+index 6dea91aedf3..d88e6130b9d 100644
@@ -180 +181 @@
-index 7541440877..44acd4ef51 100644
+index 8cdb8a72dd3..bc1489d9854 100644
@@ -183 +184 @@
-@@ -471,13 +471,13 @@ cnxk_tim_parse_ring_param(char *value, void *opaque)
+@@ -464,13 +464,13 @@ cnxk_tim_parse_ring_param(char *value, void *opaque)
@@ -200 +201 @@
-index 6a9099a23f..9e33ff58d6 100644
+index 09f84091abb..a3305386181 100644
@@ -203 +204 @@
-@@ -726,6 +726,7 @@ cnxk_tim_add_entry_tmo_hwwqe(struct cnxk_tim_ring *const tim_ring,
+@@ -725,6 +725,7 @@ cnxk_tim_add_entry_tmo_hwwqe(struct cnxk_tim_ring *const tim_ring,