[dpdk-dev] [PATCH v1] net/mlx5: fix RSS flow configuration crash

[Moti Haimovsky]

This commit fixes a segmentation fault observed when configuring
mlx5 with RSS flow rule containing invalid queues indices such as
negative numbers, queue numbers bigger than the number Rx queues the
PMD or has no queues at all.

Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
Cc: nelio.laranjeiro at 6wind.com

Signed-off-by: Moti Haimovsky <motih at mellanox.com>
---
v1:
* Added check for zero queues.
---
 drivers/net/mlx5/mlx5_flow.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 6c3021a..d32b86d 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -2065,6 +2065,11 @@ struct mlx5_flow_tunnel_info {
 					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
 					  &rss->key_len,
 					  "RSS hash key too large");
+	if (!rss->queue_num)
+		return rte_flow_error_set(error, ENOTSUP,
+					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
+					  &rss->queue_num,
+					  "no queues were provided for RSS");
 	if (rss->queue_num > priv->config.ind_table_max_size)
 		return rte_flow_error_set(error, ENOTSUP,
 					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
@@ -2077,6 +2082,12 @@ struct mlx5_flow_tunnel_info {
 					  "some RSS protocols are not"
 					  " supported");
 	for (i = 0; i != rss->queue_num; ++i) {
+		if (rss->queue[i] >= priv->rxqs_n)
+			return rte_flow_error_set
+				(error, EINVAL,
+				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
+				 &rss->queue[i],
+				 "queue index out of range");
 		if (!(*priv->rxqs)[rss->queue[i]])
 			return rte_flow_error_set
 				(error, EINVAL,
-- 
1.8.3.1