From mboxrd@z Thu Jan 1 00:00:00 1970 From: Moti Haimovsky Subject: [PATCH v1] net/mlx5: fix RSS flow configuration crash Date: Wed, 1 Aug 2018 16:40:07 +0300 Message-ID: <1533130807-9183-1-git-send-email-motih@mellanox.com> References: <1533120218-32538-1-git-send-email-motih@mellanox.com> Mime-Version: 1.0 Content-Type: text/plain Cc: dev@dpdk.org, Moti Haimovsky , nelio.laranjeiro@6wind.com To: shahafs@mellanox.com Return-path: Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20083.outbound.protection.outlook.com [40.107.2.83]) by dpdk.org (Postfix) with ESMTP id AFEAE5F3B for ; Wed, 1 Aug 2018 15:40:37 +0200 (CEST) In-Reply-To: <1533120218-32538-1-git-send-email-motih@mellanox.com> List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" This commit fixes a segmentation fault observed when configuring mlx5 with RSS flow rule containing invalid queues indices such as negative numbers, queue numbers bigger than the number Rx queues the PMD or has no queues at all. Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action") Cc: nelio.laranjeiro@6wind.com Signed-off-by: Moti Haimovsky --- v1: * Added check for zero queues. --- drivers/net/mlx5/mlx5_flow.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c index 6c3021a..d32b86d 100644 --- a/drivers/net/mlx5/mlx5_flow.c +++ b/drivers/net/mlx5/mlx5_flow.c @@ -2065,6 +2065,11 @@ struct mlx5_flow_tunnel_info { RTE_FLOW_ERROR_TYPE_ACTION_CONF, &rss->key_len, "RSS hash key too large"); + if (!rss->queue_num) + return rte_flow_error_set(error, ENOTSUP, + RTE_FLOW_ERROR_TYPE_ACTION_CONF, + &rss->queue_num, + "no queues were provided for RSS"); if (rss->queue_num > priv->config.ind_table_max_size) return rte_flow_error_set(error, ENOTSUP, RTE_FLOW_ERROR_TYPE_ACTION_CONF, @@ -2077,6 +2082,12 @@ struct mlx5_flow_tunnel_info { "some RSS protocols are not" " supported"); for (i = 0; i != rss->queue_num; ++i) { + if (rss->queue[i] >= priv->rxqs_n) + return rte_flow_error_set + (error, EINVAL, + RTE_FLOW_ERROR_TYPE_ACTION_CONF, + &rss->queue[i], + "queue index out of range"); if (!(*priv->rxqs)[rss->queue[i]]) return rte_flow_error_set (error, EINVAL, -- 1.8.3.1