diff mbox series

net/mlx5: fix RSS flow configuration crash

Message ID 1533120218-32538-1-git-send-email-motih@mellanox.com (mailing list archive)
State Superseded, archived
Headers
Series net/mlx5: fix RSS flow configuration crash |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Moti Haimovsky Aug. 1, 2018, 10:43 a.m. UTC 
  This commit fixes a segmentation fault observed when configuring
mlx5 with RSS flow rule containing invalid queues indices such as
negative numbers or numbers bigger than the number Rx queues the PMD
is configured with.

Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
Cc: nelio.laranjeiro@6wind.com

Signed-off-by: Moti Haimovsky <motih@mellanox.com>
---
 drivers/net/mlx5/mlx5_flow.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Adrien Mazarguil Aug. 1, 2018, 11:01 a.m. UTC | #1 
On Wed, Aug 01, 2018 at 01:43:38PM +0300, Moti Haimovsky wrote:
> This commit fixes a segmentation fault observed when configuring
> mlx5 with RSS flow rule containing invalid queues indices such as
> negative numbers or numbers bigger than the number Rx queues the PMD
> is configured with.
> 
> Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
> Cc: nelio.laranjeiro@6wind.com
> 
> Signed-off-by: Moti Haimovsky <motih@mellanox.com>
> ---
>  drivers/net/mlx5/mlx5_flow.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
> index 6c3021a..0b55366 100644
> --- a/drivers/net/mlx5/mlx5_flow.c
> +++ b/drivers/net/mlx5/mlx5_flow.c
> @@ -2077,6 +2077,12 @@ struct mlx5_flow_tunnel_info {
>  					  "some RSS protocols are not"
>  					  " supported");
>  	for (i = 0; i != rss->queue_num; ++i) {
> +		if (rss->queue[i] >= priv->rxqs_n)
> +			return rte_flow_error_set
> +				(error, EINVAL,
> +				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> +				 &rss->queue[i],

When specified, the object associated with RTE_FLOW_TYPE_ACTION_CONF is the
configuration structure itself, not the data of an inner field. This type is
that of the the pointed object; the caller may attempt to dereference it
accordingly.

In short, use either "action->conf" or "rss" instead of "&rss->queue[i]"
here.
diff mbox series

Patch

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 6c3021a..0b55366 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -2077,6 +2077,12 @@  struct mlx5_flow_tunnel_info {
 					  "some RSS protocols are not"
 					  " supported");
 	for (i = 0; i != rss->queue_num; ++i) {
+		if (rss->queue[i] >= priv->rxqs_n)
+			return rte_flow_error_set
+				(error, EINVAL,
+				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
+				 &rss->queue[i],
+				 "queue index out of range");
 		if (!(*priv->rxqs)[rss->queue[i]])
 			return rte_flow_error_set
 				(error, EINVAL,