[dpdk-dev] [PATCH v2] net/mlx5: fix RSS flow configuration crash

[Shahaf Shuler]

Thursday, August 2, 2018 11:41 AM, Mordechay Haimovsky:
> Subject: [PATCH v2] net/mlx5: fix RSS flow configuration crash
> 
> This commit fixes a segmentation fault observed when configuring
> mlx5 with RSS flow rule containing invalid queues indices such as negative
> numbers, queue numbers bigger than the number Rx queues the PMD or
> has no queues at all.
> 
> Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
> Cc: nelio.laranjeiro at 6wind.com
> 
> Signed-off-by: Moti Haimovsky <motih at mellanox.com>

Applied to next-net-mlx, thanks. 

> ---
> v2:
> * Modifications according to review by Adrien Mazarguil.
>   in reply to 1533130807-9183-1-git-send-email-motih at mellanox.com
> v1:
> * Added check for zero queues.
> ---
>  drivers/net/mlx5/mlx5_flow.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
> index 6c3021a..5576044 100644
> --- a/drivers/net/mlx5/mlx5_flow.c
> +++ b/drivers/net/mlx5/mlx5_flow.c
> @@ -2065,6 +2065,11 @@ struct mlx5_flow_tunnel_info {
> 
> RTE_FLOW_ERROR_TYPE_ACTION_CONF,
>  					  &rss->key_len,
>  					  "RSS hash key too large");
> +	if (!rss->queue_num)
> +		return rte_flow_error_set(error, ENOTSUP,
> +
> RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> +					  &rss->queue_num,
> +	
				  "no queues were provided for

This is OK as a temporary fix. We should plan to support better OOB experience by using all the queues instead. 

> RSS");
>  	if (rss->queue_num > priv->config.ind_table_max_size)
>  		return rte_flow_error_set(error, ENOTSUP,
> 
> RTE_FLOW_ERROR_TYPE_ACTION_CONF, @@ -2077,6 +2082,12 @@ struct
> mlx5_flow_tunnel_info {
>  					  "some RSS protocols are not"
>  					  " supported");
>  	for (i = 0; i != rss->queue_num; ++i) {
> +		if (rss->queue[i] >= priv->rxqs_n)
> +			return rte_flow_error_set
> +				(error, EINVAL,
> +				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> +				 rss,
> +				 "queue index out of range");
>  		if (!(*priv->rxqs)[rss->queue[i]])
>  			return rte_flow_error_set
>  				(error, EINVAL,
> --
> 1.8.3.1