diff mbox series

[v2,2/5] app/testpmd: fix RSS key length

Message ID 20210922095742.229262-3-maxime.coquelin@redhat.com (mailing list archive)
State Superseded
Delegated to: Maxime Coquelin
Headers show
Series Virtio PMD RSS support & RSS fixes | expand

Checks

Context Check Description
ci/checkpatch success coding style OK

Commit Message

Maxime Coquelin Sept. 22, 2021, 9:57 a.m. UTC
port_rss_hash_key_update() initializes rss_conf with the
RSS key configuration provided  by the user, but it calls
rte_eth_dev_rss_hash_conf_get() before calling
rte_eth_dev_rss_hash_update(), which overrides the parsed
RSS config.

While the RSS key value is set again after, this is not
the case of the key length. It could cause out of bounds
access if the key length parsed is smaller than the one
read from rte_eth_dev_rss_hash_conf_get().

This patch restores the key length before the
rte_eth_dev_rss_hash_update() call to ensure the RSS key
value/length pair is consistent.

Fixes: 8205e241b2b0 ("app/testpmd: add missing type to RSS hash commands")
Cc: stable@dpdk.org

Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
---
 app/test-pmd/config.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Xiaoyun Li Sept. 22, 2021, 11:25 a.m. UTC | #1
> -----Original Message-----
> From: Maxime Coquelin <maxime.coquelin@redhat.com>
> Sent: Wednesday, September 22, 2021 17:58
> To: dev@dpdk.org; Xia, Chenbo <chenbo.xia@intel.com>;
> amorenoz@redhat.com; david.marchand@redhat.com;
> andrew.rybchenko@oktetlabs.ru; Yigit, Ferruh <ferruh.yigit@intel.com>;
> michaelba@nvidia.com; viacheslavo@nvidia.com; Li, Xiaoyun
> <xiaoyun.li@intel.com>
> Cc: stable@dpdk.org; nelio.laranjeiro@6wind.com; yvugenfi@redhat.com;
> ybendito@redhat.com; Maxime Coquelin <maxime.coquelin@redhat.com>
> Subject: [PATCH v2 2/5] app/testpmd: fix RSS key length
> 
> port_rss_hash_key_update() initializes rss_conf with the RSS key configuration
> provided  by the user, but it calls
> rte_eth_dev_rss_hash_conf_get() before calling rte_eth_dev_rss_hash_update(),
> which overrides the parsed RSS config.
> 
> While the RSS key value is set again after, this is not the case of the key length. It
> could cause out of bounds access if the key length parsed is smaller than the one
> read from rte_eth_dev_rss_hash_conf_get().
> 
> This patch restores the key length before the
> rte_eth_dev_rss_hash_update() call to ensure the RSS key value/length pair is
> consistent.
> 
> Fixes: 8205e241b2b0 ("app/testpmd: add missing type to RSS hash commands")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
> ---
>  app/test-pmd/config.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/app/test-pmd/config.c b/app/test-pmd/config.c index
> 9c66329e96..611965769c 100644
> --- a/app/test-pmd/config.c
> +++ b/app/test-pmd/config.c
> @@ -2854,7 +2854,7 @@ port_rss_hash_key_update(portid_t port_id, char
> rss_type[], uint8_t *hash_key,
>  	unsigned int i;
> 
>  	rss_conf.rss_key = NULL;
> -	rss_conf.rss_key_len = hash_key_len;
> +	rss_conf.rss_key_len = 0;
>  	rss_conf.rss_hf = 0;
>  	for (i = 0; rss_type_table[i].str; i++) {
>  		if (!strcmp(rss_type_table[i].str, rss_type)) @@ -2863,6 +2863,7
> @@ port_rss_hash_key_update(portid_t port_id, char rss_type[], uint8_t
> *hash_key,
>  	diag = rte_eth_dev_rss_hash_conf_get(port_id, &rss_conf);
>  	if (diag == 0) {
>  		rss_conf.rss_key = hash_key;
> +		rss_conf.rss_key_len = hash_key_len;
>  		diag = rte_eth_dev_rss_hash_update(port_id, &rss_conf);
>  	}
>  	if (diag == 0)
> --
> 2.31.1

Acked-by: Xiaoyun Li <xiaoyun.li@intel.com>
Xia, Chenbo Sept. 23, 2021, 7:52 a.m. UTC | #2
> -----Original Message-----
> From: Maxime Coquelin <maxime.coquelin@redhat.com>
> Sent: Wednesday, September 22, 2021 5:58 PM
> To: dev@dpdk.org; Xia, Chenbo <chenbo.xia@intel.com>; amorenoz@redhat.com;
> david.marchand@redhat.com; andrew.rybchenko@oktetlabs.ru; Yigit, Ferruh
> <ferruh.yigit@intel.com>; michaelba@nvidia.com; viacheslavo@nvidia.com; Li,
> Xiaoyun <xiaoyun.li@intel.com>
> Cc: stable@dpdk.org; nelio.laranjeiro@6wind.com; yvugenfi@redhat.com;
> ybendito@redhat.com; Maxime Coquelin <maxime.coquelin@redhat.com>
> Subject: [PATCH v2 2/5] app/testpmd: fix RSS key length
> 
> port_rss_hash_key_update() initializes rss_conf with the
> RSS key configuration provided  by the user, but it calls

Double space between 'provided' and 'by'

With this fixed:

Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>

> rte_eth_dev_rss_hash_conf_get() before calling
> rte_eth_dev_rss_hash_update(), which overrides the parsed
> RSS config.
> 
> While the RSS key value is set again after, this is not
> the case of the key length. It could cause out of bounds
> access if the key length parsed is smaller than the one
> read from rte_eth_dev_rss_hash_conf_get().
> 
> This patch restores the key length before the
> rte_eth_dev_rss_hash_update() call to ensure the RSS key
> value/length pair is consistent.
> 
> Fixes: 8205e241b2b0 ("app/testpmd: add missing type to RSS hash commands")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
diff mbox series

Patch

diff --git a/app/test-pmd/config.c b/app/test-pmd/config.c
index 9c66329e96..611965769c 100644
--- a/app/test-pmd/config.c
+++ b/app/test-pmd/config.c
@@ -2854,7 +2854,7 @@  port_rss_hash_key_update(portid_t port_id, char rss_type[], uint8_t *hash_key,
 	unsigned int i;
 
 	rss_conf.rss_key = NULL;
-	rss_conf.rss_key_len = hash_key_len;
+	rss_conf.rss_key_len = 0;
 	rss_conf.rss_hf = 0;
 	for (i = 0; rss_type_table[i].str; i++) {
 		if (!strcmp(rss_type_table[i].str, rss_type))
@@ -2863,6 +2863,7 @@  port_rss_hash_key_update(portid_t port_id, char rss_type[], uint8_t *hash_key,
 	diag = rte_eth_dev_rss_hash_conf_get(port_id, &rss_conf);
 	if (diag == 0) {
 		rss_conf.rss_key = hash_key;
+		rss_conf.rss_key_len = hash_key_len;
 		diag = rte_eth_dev_rss_hash_update(port_id, &rss_conf);
 	}
 	if (diag == 0)