netdev - [bug query] octeontx2/cn10k: CPT LF IQ drain loop compares DQ

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <a3fd45b2-bfed-4780-8351-a99f640df87f@oracle.com>
Date: Tue, 13 Jan 2026 22:24:48 +0530
From: ALOK TIWARI <alok.a.tiwari@...cle.com>
To: sgoutham@...vell.com, gakula@...vell.com, sbhatta@...vell.com,
        bbhushan2@...vell.com, Hariprasad Kelam <hkelam@...vell.com>,
        Andrew Lunn <andrew+netdev@...n.ch>,
        "David S. Miller"
 <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc: "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: [bug query] octeontx2/cn10k: CPT LF IQ drain loop compares DQ_PTR
 twice


Hi Bharat,

In cn10k_outb_cptlf_iq_disable(), there is a potential issue in the 
instruction queue drain loop.

The code reads CN10K_CPT_LF_Q_GRP_PTR and compares nq_ptr and dq_ptr to
check whether the queue is empty.
However, both values are extracted using CPT_LF_Q_GRP_PTR_DQ_PTR, so the
comparison is ineffective and may allow the loop to exit while entries 
are still pending.

The fix extracts nq_ptr using CPT_LF_Q_GRP_PTR_NQ_PTR, which correctly
compares the enqueue and dequeue pointers.

Diff:

- nq_ptr = FIELD_GET(CPT_LF_Q_GRP_PTR_DQ_PTR, reg_val);
+ nq_ptr = FIELD_GET(CPT_LF_Q_GRP_PTR_NQ_PTR, reg_val);


Please confirm whether CPT_LF_Q_GRP_PTR_NQ_PTR is the correct enqueue
pointer for CN10K CPT LF.


Fixes: fe079ab05d49 ("cn10k-ipsec: Init hardware for outbound ipsec 
crypto offload")


Thanks,
Alok

---

--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c
@@ -195,7 +195,7 @@ static void cn10k_outb_cptlf_iq_disable(struct 
otx2_nic *pf)
                 else
                         cnt++;
                 reg_val = otx2_read64(pf, CN10K_CPT_LF_Q_GRP_PTR);
-               nq_ptr = FIELD_GET(CPT_LF_Q_GRP_PTR_DQ_PTR, reg_val);
+               nq_ptr = FIELD_GET(CPT_LF_Q_GRP_PTR_NQ_PTR, reg_val);
                 dq_ptr = FIELD_GET(CPT_LF_Q_GRP_PTR_DQ_PTR, reg_val);
         } while ((cnt < 10) && (nq_ptr != dq_ptr));