[dpdk-dev] [PATCH] net/mlx5: fix possible endless loop when clearing flow flags

[Ori Kam]

> -----Original Message-----
> From: dev [mailto:dev-bounces at dpdk.org] On Behalf Of Yongseok Koh
> Sent: Monday, July 23, 2018 9:28 PM
> To: Shahaf Shuler <shahafs at mellanox.com>
> Cc: dev at dpdk.org; Yongseok Koh <yskoh at mellanox.com>; Nélio Laranjeiro
> <nelio.laranjeiro at 6wind.com>
> Subject: [dpdk-dev] [PATCH] net/mlx5: fix possible endless loop when
> clearing flow flags
> 
> If one of (*priv->rxqs)[] is null, the for loop can iterate infinitely as
> idx can't be increased.
> 
> Fixes: cd24d526395e ("net/mlx5: add mark/flag flow action")
> Cc: Nelio Laranjeiro <nelio.laranjeiro at 6wind.com>
> 
> Signed-off-by: Yongseok Koh <yskoh at mellanox.com>
> ---
>  drivers/net/mlx5/mlx5_flow.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
> index 32854198b..c156f01eb 100644
> --- a/drivers/net/mlx5/mlx5_flow.c
> +++ b/drivers/net/mlx5/mlx5_flow.c
> @@ -2762,22 +2762,20 @@ mlx5_flow_rxq_flags_clear(struct rte_eth_dev
> *dev)
>  {
>  	struct priv *priv = dev->data->dev_private;
>  	unsigned int i;
> -	unsigned int idx;
> 
> -	for (idx = 0, i = 0; idx != priv->rxqs_n; ++i) {
> +	for (i = 0; i != priv->rxqs_n; ++i) {
>  		struct mlx5_rxq_ctrl *rxq_ctrl;
>  		unsigned int j;
> 
> -		if (!(*priv->rxqs)[idx])
> +		if (!(*priv->rxqs)[i])
>  			continue;
> -		rxq_ctrl = container_of((*priv->rxqs)[idx],
> +		rxq_ctrl = container_of((*priv->rxqs)[i],
>  					struct mlx5_rxq_ctrl, rxq);
>  		rxq_ctrl->flow_mark_n = 0;
>  		rxq_ctrl->rxq.mark = 0;
>  		for (j = 0; j != MLX5_FLOW_TUNNEL; ++j)
>  			rxq_ctrl->flow_tunnels_n[j] = 0;
>  		rxq_ctrl->rxq.tunnel = 0;
> -		++idx;
>  	}
>  }
> 

Acked-by: Ori Kam <orika at mellanox.com>

> --
> 2.11.0