[02/16] net/hns3: fix possible truncation of redirection table
Checks
Commit Message
From: Huisong Li <lihuisong@huawei.com>
The size of the redirection table is obtained from firmware. If the size
isn't a multiple of HNS3_RSS_CFG_TBL_SIZE, the redirection table from
user will be truncated.
Fixes: c37ca66f2b27 ("net/hns3: support RSS")
Cc: stable@dpdk.org
Signed-off-by: Huisong Li <lihuisong@huawei.com>
Signed-off-by: Dongdong Liu <liudongdong3@huawei.com>
---
drivers/net/hns3/hns3_rss.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
Comments
On 3/10/2023 9:35 AM, Dongdong Liu wrote:
> From: Huisong Li <lihuisong@huawei.com>
>
> The size of the redirection table is obtained from firmware. If the size
> isn't a multiple of HNS3_RSS_CFG_TBL_SIZE, the redirection table from
> user will be truncated.
>
> Fixes: c37ca66f2b27 ("net/hns3: support RSS")
> Cc: stable@dpdk.org
>
> Signed-off-by: Huisong Li <lihuisong@huawei.com>
> Signed-off-by: Dongdong Liu <liudongdong3@huawei.com>
> ---
> drivers/net/hns3/hns3_rss.c | 16 +++++++++++-----
> 1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/hns3/hns3_rss.c b/drivers/net/hns3/hns3_rss.c
> index 2011c18b9b..f6d677ade8 100644
> --- a/drivers/net/hns3/hns3_rss.c
> +++ b/drivers/net/hns3/hns3_rss.c
> @@ -329,22 +329,28 @@ int
> hns3_set_rss_indir_table(struct hns3_hw *hw, uint16_t *indir, uint16_t size)
> {
> struct hns3_rss_indirection_table_cmd *req;
> + uint16_t max_bd_num, cfg_tbl_size;
> + uint8_t qid_msb_off, qid_msb_val;
> struct hns3_cmd_desc desc;
> - uint8_t qid_msb_off;
> - uint8_t qid_msb_val;
This change seems unrelated, I can drop while merging if there is no
other change request.
> uint16_t q_id;
> uint16_t i, j;
> int ret;
>
> req = (struct hns3_rss_indirection_table_cmd *)desc.data;
> -
> - for (i = 0; i < size / HNS3_RSS_CFG_TBL_SIZE; i++) {
> + max_bd_num = DIV_ROUND_UP(size, HNS3_RSS_CFG_TBL_SIZE);
> + for (i = 0; i < max_bd_num; i++) {
> hns3_cmd_setup_basic_desc(&desc, HNS3_OPC_RSS_INDIR_TABLE,
> false);
> req->start_table_index =
> rte_cpu_to_le_16(i * HNS3_RSS_CFG_TBL_SIZE);
> req->rss_set_bitmap = rte_cpu_to_le_16(HNS3_RSS_SET_BITMAP_MSK);
> - for (j = 0; j < HNS3_RSS_CFG_TBL_SIZE; j++) {
> +
> + if (i == max_bd_num - 1 && (size % HNS3_RSS_CFG_TBL_SIZE) != 0)
> + cfg_tbl_size = size % HNS3_RSS_CFG_TBL_SIZE;
> + else
> + cfg_tbl_size = HNS3_RSS_CFG_TBL_SIZE;
> +
> + for (j = 0; j < cfg_tbl_size; j++) {
> q_id = indir[i * HNS3_RSS_CFG_TBL_SIZE + j];
> req->rss_result_l[j] = q_id & 0xff;
>
@@ -329,22 +329,28 @@ int
hns3_set_rss_indir_table(struct hns3_hw *hw, uint16_t *indir, uint16_t size)
{
struct hns3_rss_indirection_table_cmd *req;
+ uint16_t max_bd_num, cfg_tbl_size;
+ uint8_t qid_msb_off, qid_msb_val;
struct hns3_cmd_desc desc;
- uint8_t qid_msb_off;
- uint8_t qid_msb_val;
uint16_t q_id;
uint16_t i, j;
int ret;
req = (struct hns3_rss_indirection_table_cmd *)desc.data;
-
- for (i = 0; i < size / HNS3_RSS_CFG_TBL_SIZE; i++) {
+ max_bd_num = DIV_ROUND_UP(size, HNS3_RSS_CFG_TBL_SIZE);
+ for (i = 0; i < max_bd_num; i++) {
hns3_cmd_setup_basic_desc(&desc, HNS3_OPC_RSS_INDIR_TABLE,
false);
req->start_table_index =
rte_cpu_to_le_16(i * HNS3_RSS_CFG_TBL_SIZE);
req->rss_set_bitmap = rte_cpu_to_le_16(HNS3_RSS_SET_BITMAP_MSK);
- for (j = 0; j < HNS3_RSS_CFG_TBL_SIZE; j++) {
+
+ if (i == max_bd_num - 1 && (size % HNS3_RSS_CFG_TBL_SIZE) != 0)
+ cfg_tbl_size = size % HNS3_RSS_CFG_TBL_SIZE;
+ else
+ cfg_tbl_size = HNS3_RSS_CFG_TBL_SIZE;
+
+ for (j = 0; j < cfg_tbl_size; j++) {
q_id = indir[i * HNS3_RSS_CFG_TBL_SIZE + j];
req->rss_result_l[j] = q_id & 0xff;