diff mbox series

[v2] net/mlx5: fix RSS flow configuration crash

Message ID 1533199267-9658-1-git-send-email-motih@mellanox.com (mailing list archive)
State Accepted, archived
Delegated to: Shahaf Shuler
Headers
Series [v2] net/mlx5: fix RSS flow configuration crash |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Moti Haimovsky Aug. 2, 2018, 8:41 a.m. UTC 
  This commit fixes a segmentation fault observed when configuring
mlx5 with RSS flow rule containing invalid queues indices such as
negative numbers, queue numbers bigger than the number Rx queues the
PMD or has no queues at all.

Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
Cc: nelio.laranjeiro@6wind.com

Signed-off-by: Moti Haimovsky <motih@mellanox.com>
---
v2:
* Modifications according to review by Adrien Mazarguil.
  in reply to 1533130807-9183-1-git-send-email-motih@mellanox.com
v1:
* Added check for zero queues.
---
 drivers/net/mlx5/mlx5_flow.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

Comments

Shahaf Shuler Aug. 2, 2018, 11:17 a.m. UTC | #1 
Thursday, August 2, 2018 11:41 AM, Mordechay Haimovsky:
> Subject: [PATCH v2] net/mlx5: fix RSS flow configuration crash
> 
> This commit fixes a segmentation fault observed when configuring
> mlx5 with RSS flow rule containing invalid queues indices such as negative
> numbers, queue numbers bigger than the number Rx queues the PMD or
> has no queues at all.
> 
> Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
> Cc: nelio.laranjeiro@6wind.com
> 
> Signed-off-by: Moti Haimovsky <motih@mellanox.com>

Applied to next-net-mlx, thanks. 

> ---
> v2:
> * Modifications according to review by Adrien Mazarguil.
>   in reply to 1533130807-9183-1-git-send-email-motih@mellanox.com
> v1:
> * Added check for zero queues.
> ---
>  drivers/net/mlx5/mlx5_flow.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
> index 6c3021a..5576044 100644
> --- a/drivers/net/mlx5/mlx5_flow.c
> +++ b/drivers/net/mlx5/mlx5_flow.c
> @@ -2065,6 +2065,11 @@ struct mlx5_flow_tunnel_info {
> 
> RTE_FLOW_ERROR_TYPE_ACTION_CONF,
>  					  &rss->key_len,
>  					  "RSS hash key too large");
> +	if (!rss->queue_num)
> +		return rte_flow_error_set(error, ENOTSUP,
> +
> RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> +					  &rss->queue_num,
> +	
				  "no queues were provided for

This is OK as a temporary fix. We should plan to support better OOB experience by using all the queues instead. 

> RSS");
>  	if (rss->queue_num > priv->config.ind_table_max_size)
>  		return rte_flow_error_set(error, ENOTSUP,
> 
> RTE_FLOW_ERROR_TYPE_ACTION_CONF, @@ -2077,6 +2082,12 @@ struct
> mlx5_flow_tunnel_info {
>  					  "some RSS protocols are not"
>  					  " supported");
>  	for (i = 0; i != rss->queue_num; ++i) {
> +		if (rss->queue[i] >= priv->rxqs_n)
> +			return rte_flow_error_set
> +				(error, EINVAL,
> +				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> +				 rss,
> +				 "queue index out of range");
>  		if (!(*priv->rxqs)[rss->queue[i]])
>  			return rte_flow_error_set
>  				(error, EINVAL,
> --
> 1.8.3.1
Adrien Mazarguil Aug. 2, 2018, 11:18 a.m. UTC | #2 
On Thu, Aug 02, 2018 at 11:41:07AM +0300, Moti Haimovsky wrote:
> This commit fixes a segmentation fault observed when configuring
> mlx5 with RSS flow rule containing invalid queues indices such as
> negative numbers, queue numbers bigger than the number Rx queues the
> PMD or has no queues at all.
> 
> Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
> Cc: nelio.laranjeiro@6wind.com
> 
> Signed-off-by: Moti Haimovsky <motih@mellanox.com>
> ---
> v2:
> * Modifications according to review by Adrien Mazarguil.
>   in reply to 1533130807-9183-1-git-send-email-motih@mellanox.com

Almost, there is one new occurrence with the same issue, see below.

By the way, like for "types" and "level" fields, a zero value in "queue_num"
could be interpreted as default in order to target all configured queues,
for the convenience of applications that do not care.

This is not explicitly documented so it's just a recommendation though.

> v1:
> * Added check for zero queues.
> ---
>  drivers/net/mlx5/mlx5_flow.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
> index 6c3021a..5576044 100644
> --- a/drivers/net/mlx5/mlx5_flow.c
> +++ b/drivers/net/mlx5/mlx5_flow.c
> @@ -2065,6 +2065,11 @@ struct mlx5_flow_tunnel_info {
>  					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
>  					  &rss->key_len,
>  					  "RSS hash key too large");
> +	if (!rss->queue_num)
> +		return rte_flow_error_set(error, ENOTSUP,
> +					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> +					  &rss->queue_num,

Here ^^

> +					  "no queues were provided for RSS");
>  	if (rss->queue_num > priv->config.ind_table_max_size)
>  		return rte_flow_error_set(error, ENOTSUP,
>  					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> @@ -2077,6 +2082,12 @@ struct mlx5_flow_tunnel_info {
>  					  "some RSS protocols are not"
>  					  " supported");
>  	for (i = 0; i != rss->queue_num; ++i) {
> +		if (rss->queue[i] >= priv->rxqs_n)
> +			return rte_flow_error_set
> +				(error, EINVAL,
> +				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> +				 rss,
> +				 "queue index out of range");
>  		if (!(*priv->rxqs)[rss->queue[i]])
>  			return rte_flow_error_set
>  				(error, EINVAL,
> -- 
> 1.8.3.1
>
Shahaf Shuler Aug. 2, 2018, 11:20 a.m. UTC | #3 
Thursday, August 2, 2018 2:19 PM, Adrien Mazarguil:
> Subject: Re: [PATCH v2] net/mlx5: fix RSS flow configuration crash
> 
> On Thu, Aug 02, 2018 at 11:41:07AM +0300, Moti Haimovsky wrote:
> > This commit fixes a segmentation fault observed when configuring
> > mlx5 with RSS flow rule containing invalid queues indices such as
> > negative numbers, queue numbers bigger than the number Rx queues the
> > PMD or has no queues at all.
> >
> > Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
> > Cc: nelio.laranjeiro@6wind.com
> >
> > Signed-off-by: Moti Haimovsky <motih@mellanox.com>
> > ---
> > v2:
> > * Modifications according to review by Adrien Mazarguil.
> >   in reply to 1533130807-9183-1-git-send-email-motih@mellanox.com
> 
> Almost, there is one new occurrence with the same issue, see below.
> 
> By the way, like for "types" and "level" fields, a zero value in "queue_num"
> could be interpreted as default in order to target all configured queues, for
> the convenience of applications that do not care.
> 
> This is not explicitly documented so it's just a recommendation though.
> 
> > v1:
> > * Added check for zero queues.
> > ---
> >  drivers/net/mlx5/mlx5_flow.c | 11 +++++++++++
> >  1 file changed, 11 insertions(+)
> >
> > diff --git a/drivers/net/mlx5/mlx5_flow.c
> > b/drivers/net/mlx5/mlx5_flow.c index 6c3021a..5576044 100644
> > --- a/drivers/net/mlx5/mlx5_flow.c
> > +++ b/drivers/net/mlx5/mlx5_flow.c
> > @@ -2065,6 +2065,11 @@ struct mlx5_flow_tunnel_info {
> >
> RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> >  					  &rss->key_len,
> >  					  "RSS hash key too large");
> > +	if (!rss->queue_num)
> > +		return rte_flow_error_set(error, ENOTSUP,
> > +
> RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> > +					  &rss->queue_num,

Will fix locally. No need for new version. 

> 
> Here ^^
> 
> > +					  "no queues were provided for
> RSS");
> >  	if (rss->queue_num > priv->config.ind_table_max_size)
> >  		return rte_flow_error_set(error, ENOTSUP,
> >
> RTE_FLOW_ERROR_TYPE_ACTION_CONF, @@ -2077,6 +2082,12 @@ struct
> > mlx5_flow_tunnel_info {
> >  					  "some RSS protocols are not"
> >  					  " supported");
> >  	for (i = 0; i != rss->queue_num; ++i) {
> > +		if (rss->queue[i] >= priv->rxqs_n)
> > +			return rte_flow_error_set
> > +				(error, EINVAL,
> > +				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
> > +				 rss,
> > +				 "queue index out of range");
> >  		if (!(*priv->rxqs)[rss->queue[i]])
> >  			return rte_flow_error_set
> >  				(error, EINVAL,
> > --
> > 1.8.3.1
> >
> 
> --
> Adrien Mazarguil
> 6WIND
diff mbox series

Patch

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 6c3021a..5576044 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -2065,6 +2065,11 @@  struct mlx5_flow_tunnel_info {
 					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
 					  &rss->key_len,
 					  "RSS hash key too large");
+	if (!rss->queue_num)
+		return rte_flow_error_set(error, ENOTSUP,
+					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
+					  &rss->queue_num,
+					  "no queues were provided for RSS");
 	if (rss->queue_num > priv->config.ind_table_max_size)
 		return rte_flow_error_set(error, ENOTSUP,
 					  RTE_FLOW_ERROR_TYPE_ACTION_CONF,
@@ -2077,6 +2082,12 @@  struct mlx5_flow_tunnel_info {
 					  "some RSS protocols are not"
 					  " supported");
 	for (i = 0; i != rss->queue_num; ++i) {
+		if (rss->queue[i] >= priv->rxqs_n)
+			return rte_flow_error_set
+				(error, EINVAL,
+				 RTE_FLOW_ERROR_TYPE_ACTION_CONF,
+				 rss,
+				 "queue index out of range");
 		if (!(*priv->rxqs)[rss->queue[i]])
 			return rte_flow_error_set
 				(error, EINVAL,