[dpdk-stable] patch 'net/mlx5: fix check of RSS queue index' has been queued to LTS release 18.11.6

[Kevin Traynor]

Hi,

FYI, your patch has been queued to LTS release 18.11.6

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/17/19. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable-queue

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable-queue/commit/cba8f82b30a751c9e201065fee0abde9810788f0

Thanks.

Kevin.

---
>From cba8f82b30a751c9e201065fee0abde9810788f0 Mon Sep 17 00:00:00 2001
From: Dekel Peled <dekelp at mellanox.com>
Date: Mon, 11 Nov 2019 16:32:31 +0200
Subject: [PATCH] net/mlx5: fix check of RSS queue index

[ upstream commit 97127d429876b6ac817de65c6e3c1c2d17851bfe ]

RSS action validation function checks the queues included in RSS
to make sure they are valid.
A Queue is considered valid if the pointer to the queue (item at
location queue-index of RxQ array) is not a null value.
The queue indices are not checked. If a large value is entered as
queue index, using it as an index in RxQ array will result in a
pointer to memory out of array bounds. If this memory contains a
value which is not null, this queue will be wrongly considered valid.

This patch updates function mlx5_flow_validate_action_rss() with
check of the input queue indices, as done in function
mlx5_flow_validate_action_queue().

Fixes: 23c1d42c7138 ("net/mlx5: split flow validation to dedicated function")

Signed-off-by: Dekel Peled <dekelp at mellanox.com>
Acked-by: Matan Azrad <matan at mellanox.com>
---
 drivers/net/mlx5/mlx5_flow.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 2bf535213..467af73a5 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -945,4 +945,9 @@ mlx5_flow_validate_action_rss(const struct rte_flow_action *action,
 					  " supported");
 	for (i = 0; i != rss->queue_num; ++i) {
+		if (rss->queue[i] >= priv->rxqs_n)
+			return rte_flow_error_set
+				(error, EINVAL,
+				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
+				 &rss->queue[i], "queue index out of range");
 		if (!(*priv->rxqs)[rss->queue[i]])
 			return rte_flow_error_set
-- 
2.21.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2019-12-11 21:24:15.637335946 +0000
+++ 0037-net-mlx5-fix-check-of-RSS-queue-index.patch	2019-12-11 21:24:12.672651114 +0000
@@ -1 +1 @@
-From 97127d429876b6ac817de65c6e3c1c2d17851bfe Mon Sep 17 00:00:00 2001
+From cba8f82b30a751c9e201065fee0abde9810788f0 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 97127d429876b6ac817de65c6e3c1c2d17851bfe ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -29 +30 @@
-index 092f7b4c4..14a89e2e3 100644
+index 2bf535213..467af73a5 100644
@@ -32,2 +33,2 @@
-@@ -1152,4 +1152,9 @@ mlx5_flow_validate_action_rss(const struct rte_flow_action *action,
- 					  NULL, "No queues configured");
+@@ -945,4 +945,9 @@ mlx5_flow_validate_action_rss(const struct rte_flow_action *action,
+ 					  " supported");