net/mlx5: fix NVGRE item mask handling
diff mbox series

Message ID 1595332744-6792-1-git-send-email-michaelba@mellanox.com
State Accepted, archived
Delegated to: Raslan Darawsheh
Headers show
Series
  • net/mlx5: fix NVGRE item mask handling
Related show

Checks

Context Check Description
ci/iol-testing success Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-intel-Performance success Performance Testing PASS
ci/travis-robot success Travis build: passed
ci/iol-broadcom-Performance success Performance Testing PASS
ci/Intel-compilation success Compilation OK
ci/checkpatch success coding style OK

Commit Message

Michael Baum July 21, 2020, 11:59 a.m. UTC
The flow_dv_translate_item_nvgre function add NVGRE item to matcher and
to the value.
It defines a pointer named nvrge_m that receives the item's mask into
it, and then copies some of it to the matcher.

Before copying, it checks for mask validation, and in case the mask is
NULL the function gives it a pointer to rte_flow_item_nvgre_mask.
However, the function calls from the vni mask's field before the check,
and if there is no mask, it actually does dereference to the NULL
pointer and indeed the program crashes with segfault.

Move the call from the vni field to post-validation.

Fixes: cd18e1b72f73 ("net/mlx5: fix build on Arm")
Cc: stable@dpdk.org

Signed-off-by: Michael Baum <michaelba@mellanox.com>
Acked-by: Matan Azrad <matan@mellanox.com>
---
 drivers/net/mlx5/mlx5_flow_dv.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Raslan Darawsheh July 22, 2020, 3:30 p.m. UTC | #1
Hi,

> -----Original Message-----
> From: dev <dev-bounces@dpdk.org> On Behalf Of Michael Baum
> Sent: Tuesday, July 21, 2020 2:59 PM
> To: dev@dpdk.org
> Cc: Matan Azrad <matan@mellanox.com>; Slava Ovsiienko
> <viacheslavo@mellanox.com>; stable@dpdk.org
> Subject: [dpdk-dev] [PATCH] net/mlx5: fix NVGRE item mask handling
> 
> The flow_dv_translate_item_nvgre function add NVGRE item to matcher
> and
> to the value.
> It defines a pointer named nvrge_m that receives the item's mask into
> it, and then copies some of it to the matcher.
> 
> Before copying, it checks for mask validation, and in case the mask is
> NULL the function gives it a pointer to rte_flow_item_nvgre_mask.
> However, the function calls from the vni mask's field before the check,
> and if there is no mask, it actually does dereference to the NULL
> pointer and indeed the program crashes with segfault.
> 
> Move the call from the vni field to post-validation.
> 
> Fixes: cd18e1b72f73 ("net/mlx5: fix build on Arm")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Michael Baum <michaelba@mellanox.com>
> Acked-by: Matan Azrad <matan@mellanox.com>
> ---
>  drivers/net/mlx5/mlx5_flow_dv.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow_dv.c
> b/drivers/net/mlx5/mlx5_flow_dv.c
> index f0cc7ad..caeafd9 100644
> --- a/drivers/net/mlx5/mlx5_flow_dv.c
> +++ b/drivers/net/mlx5/mlx5_flow_dv.c
> @@ -6469,8 +6469,8 @@ struct field_modify_info modify_tcp[] = {
>  	const struct rte_flow_item_nvgre *nvgre_v = item->spec;
>  	void *misc_m = MLX5_ADDR_OF(fte_match_param, matcher,
> misc_parameters);
>  	void *misc_v = MLX5_ADDR_OF(fte_match_param, key,
> misc_parameters);
> -	const char *tni_flow_id_m = (const char *)nvgre_m->tni;
> -	const char *tni_flow_id_v = (const char *)nvgre_v->tni;
> +	const char *tni_flow_id_m;
> +	const char *tni_flow_id_v;
>  	char *gre_key_m;
>  	char *gre_key_v;
>  	int size;
> @@ -6495,6 +6495,8 @@ struct field_modify_info modify_tcp[] = {
>  		return;
>  	if (!nvgre_m)
>  		nvgre_m = &rte_flow_item_nvgre_mask;
> +	tni_flow_id_m = (const char *)nvgre_m->tni;
> +	tni_flow_id_v = (const char *)nvgre_v->tni;
>  	size = sizeof(nvgre_m->tni) + sizeof(nvgre_m->flow_id);
>  	gre_key_m = MLX5_ADDR_OF(fte_match_set_misc, misc_m,
> gre_key_h);
>  	gre_key_v = MLX5_ADDR_OF(fte_match_set_misc, misc_v,
> gre_key_h);
> --
> 1.8.3.1

Patch applied to next-net-mlx,


Kindest regards,
Raslan Darawsheh

Patch
diff mbox series

diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index f0cc7ad..caeafd9 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -6469,8 +6469,8 @@  struct field_modify_info modify_tcp[] = {
 	const struct rte_flow_item_nvgre *nvgre_v = item->spec;
 	void *misc_m = MLX5_ADDR_OF(fte_match_param, matcher, misc_parameters);
 	void *misc_v = MLX5_ADDR_OF(fte_match_param, key, misc_parameters);
-	const char *tni_flow_id_m = (const char *)nvgre_m->tni;
-	const char *tni_flow_id_v = (const char *)nvgre_v->tni;
+	const char *tni_flow_id_m;
+	const char *tni_flow_id_v;
 	char *gre_key_m;
 	char *gre_key_v;
 	int size;
@@ -6495,6 +6495,8 @@  struct field_modify_info modify_tcp[] = {
 		return;
 	if (!nvgre_m)
 		nvgre_m = &rte_flow_item_nvgre_mask;
+	tni_flow_id_m = (const char *)nvgre_m->tni;
+	tni_flow_id_v = (const char *)nvgre_v->tni;
 	size = sizeof(nvgre_m->tni) + sizeof(nvgre_m->flow_id);
 	gre_key_m = MLX5_ADDR_OF(fte_match_set_misc, misc_m, gre_key_h);
 	gre_key_v = MLX5_ADDR_OF(fte_match_set_misc, misc_v, gre_key_h);