[PATCH 0/2] check illegal packets

[PATCH 0/2] check illegal packets

[Kevin Liu]

Check whether the data packet is illegal of ice and iavf driver.

Kevin Liu (2):
  net/iavf: check illegal packets
  net/ice: check illegal packets

 drivers/net/iavf/iavf_rxtx.c | 10 +++++++++-
 drivers/net/iavf/iavf_rxtx.h |  2 ++
 drivers/net/ice/ice_rxtx.c   | 13 +++++++++++++
 drivers/net/ice/ice_rxtx.h   |  2 ++
 4 files changed, 26 insertions(+), 1 deletion(-)

-- 
2.25.1

[PATCH 1/2] net/iavf: check illegal packets

[Kevin Liu]

Some illegal packets will lead to TX/RX hang and
can't recover automatically. This patch check those
illegal packets and protect TX/RX from hanging.

Fixes: a2b29a7733ef ("net/avf: enable basic Rx Tx")
Signed-off-by: Kevin Liu <kevinx.liu@intel.com>
---
 drivers/net/iavf/iavf_rxtx.c | 10 +++++++++-
 drivers/net/iavf/iavf_rxtx.h |  2 ++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/net/iavf/iavf_rxtx.c b/drivers/net/iavf/iavf_rxtx.c
index 3deabe1d7e..8ddd809f94 100644
--- a/drivers/net/iavf/iavf_rxtx.c
+++ b/drivers/net/iavf/iavf_rxtx.c
@@ -2877,7 +2877,8 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 
 		/* Check condition for nb_segs > IAVF_TX_MAX_MTU_SEG. */
 		if (!(ol_flags & RTE_MBUF_F_TX_TCP_SEG)) {
-			if (m->nb_segs > IAVF_TX_MAX_MTU_SEG) {
+			if (m->nb_segs > IAVF_TX_MAX_MTU_SEG ||
+				m->pkt_len > IAVF_FRAME_SIZE_MAX) {
 				rte_errno = EINVAL;
 				return i;
 			}
@@ -2893,6 +2894,13 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 			return i;
 		}
 
+		/* check the size of packet */
+		if (m->pkt_len < IAVF_TX_MIN_PKT_LEN) {
+			rte_errno = EINVAL;
+			PMD_DRV_LOG(ERR, "INVALID mbuf: bad pkt_len=[%hu]", m->pkt_len);
+			return i;
+		}
+
 #ifdef RTE_ETHDEV_DEBUG_TX
 		ret = rte_validate_tx_offload(m);
 		if (ret != 0) {
diff --git a/drivers/net/iavf/iavf_rxtx.h b/drivers/net/iavf/iavf_rxtx.h
index 1695e43cd5..bb9083c699 100644
--- a/drivers/net/iavf/iavf_rxtx.h
+++ b/drivers/net/iavf/iavf_rxtx.h
@@ -53,6 +53,8 @@
 #define IAVF_TSO_MAX_SEG          UINT8_MAX
 #define IAVF_TX_MAX_MTU_SEG       8
 
+#define IAVF_TX_MIN_PKT_LEN 17
+
 #define IAVF_TX_CKSUM_OFFLOAD_MASK (		 \
 		RTE_MBUF_F_TX_IP_CKSUM |		 \
 		RTE_MBUF_F_TX_L4_MASK |		 \
-- 
2.25.1

[PATCH 2/2] net/ice: check illegal packets

[Kevin Liu]

Some illegal packets will lead to TX/RX hang and
can't recover automatically. This patch check those
illegal packets and protect TX/RX from hanging.

Fixes: 17c7d0f9d6a4 ("net/ice: support basic Rx/Tx")
Signed-off-by: Kevin Liu <kevinx.liu@intel.com>
---
 drivers/net/ice/ice_rxtx.c | 13 +++++++++++++
 drivers/net/ice/ice_rxtx.h |  2 ++
 2 files changed, 15 insertions(+)

diff --git a/drivers/net/ice/ice_rxtx.c b/drivers/net/ice/ice_rxtx.c
index 5af7c0c8f6..0d0b093537 100644
--- a/drivers/net/ice/ice_rxtx.c
+++ b/drivers/net/ice/ice_rxtx.c
@@ -3458,6 +3458,19 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 			return i;
 		}
 
+		/* check the size of packet */
+		if (!(ol_flags & RTE_MBUF_F_TX_TCP_SEG) &&
+			m->pkt_len > ICE_FRAME_SIZE_MAX) {
+			rte_errno = EINVAL;
+			PMD_DRV_LOG(ERR, "INVALID mbuf: bad pkt_len=[%hu]", m->pkt_len);
+			return i;
+		}
+		if (m->pkt_len < ICE_TX_MIN_PKT_LEN) {
+			rte_errno = EINVAL;
+			PMD_DRV_LOG(ERR, "INVALID mbuf: bad pkt_len=[%hu]", m->pkt_len);
+			return i;
+		}
+
 #ifdef RTE_ETHDEV_DEBUG_TX
 		ret = rte_validate_tx_offload(m);
 		if (ret != 0) {
diff --git a/drivers/net/ice/ice_rxtx.h b/drivers/net/ice/ice_rxtx.h
index 6c08c175dc..e1d4fe8e47 100644
--- a/drivers/net/ice/ice_rxtx.h
+++ b/drivers/net/ice/ice_rxtx.h
@@ -40,6 +40,8 @@
 
 #define ICE_RXDID_COMMS_OVS	22
 
+#define ICE_TX_MIN_PKT_LEN 17
+
 extern uint64_t ice_timestamp_dynflag;
 extern int ice_timestamp_dynfield_offset;
 
-- 
2.25.1

RE: [PATCH 1/2] net/iavf: check illegal packets

[Zhang, Qi Z]

> -----Original Message-----
> From: Liu, KevinX <kevinx.liu@intel.com>
> Sent: Thursday, September 22, 2022 3:04 PM
> To: dev@dpdk.org
> Cc: Yang, Qiming <qiming.yang@intel.com>; Zhang, Qi Z
> <qi.z.zhang@intel.com>; Yang, SteveX <stevex.yang@intel.com>; Xing, Beilei
> <beilei.xing@intel.com>; Wu, Jingjing <jingjing.wu@intel.com>; Liu, KevinX
> <kevinx.liu@intel.com>
> Subject: [PATCH 1/2] net/iavf: check illegal packets
> 
> Some illegal packets will lead to TX/RX hang and can't recover automatically.
> This patch check those illegal packets and protect TX/RX from hanging.

Better to describe precisely what kind of illegal packets you are going to prevent.

> 
> Fixes: a2b29a7733ef ("net/avf: enable basic Rx Tx")
> Signed-off-by: Kevin Liu <kevinx.liu@intel.com>
> ---
>  drivers/net/iavf/iavf_rxtx.c | 10 +++++++++-  drivers/net/iavf/iavf_rxtx.h |  2
> ++
>  2 files changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/iavf/iavf_rxtx.c b/drivers/net/iavf/iavf_rxtx.c index
> 3deabe1d7e..8ddd809f94 100644
> --- a/drivers/net/iavf/iavf_rxtx.c
> +++ b/drivers/net/iavf/iavf_rxtx.c
> @@ -2877,7 +2877,8 @@ iavf_prep_pkts(__rte_unused void *tx_queue,
> struct rte_mbuf **tx_pkts,
> 
>  		/* Check condition for nb_segs > IAVF_TX_MAX_MTU_SEG.
> */
>  		if (!(ol_flags & RTE_MBUF_F_TX_TCP_SEG)) {
> -			if (m->nb_segs > IAVF_TX_MAX_MTU_SEG) {
> +			if (m->nb_segs > IAVF_TX_MAX_MTU_SEG ||
> +				m->pkt_len > IAVF_FRAME_SIZE_MAX) {
>  				rte_errno = EINVAL;
>  				return i;
>  			}
> @@ -2893,6 +2894,13 @@ iavf_prep_pkts(__rte_unused void *tx_queue,
> struct rte_mbuf **tx_pkts,
>  			return i;
>  		}
> 
> +		/* check the size of packet */
> +		if (m->pkt_len < IAVF_TX_MIN_PKT_LEN) {
> +			rte_errno = EINVAL;
> +			PMD_DRV_LOG(ERR, "INVALID mbuf: bad
> pkt_len=[%hu]", m->pkt_len);
> +			return i;
> +		}
> +
>  #ifdef RTE_ETHDEV_DEBUG_TX
>  		ret = rte_validate_tx_offload(m);
>  		if (ret != 0) {
> diff --git a/drivers/net/iavf/iavf_rxtx.h b/drivers/net/iavf/iavf_rxtx.h index
> 1695e43cd5..bb9083c699 100644
> --- a/drivers/net/iavf/iavf_rxtx.h
> +++ b/drivers/net/iavf/iavf_rxtx.h
> @@ -53,6 +53,8 @@
>  #define IAVF_TSO_MAX_SEG          UINT8_MAX
>  #define IAVF_TX_MAX_MTU_SEG       8
> 
> +#define IAVF_TX_MIN_PKT_LEN 17
> +
>  #define IAVF_TX_CKSUM_OFFLOAD_MASK (		 \
>  		RTE_MBUF_F_TX_IP_CKSUM |		 \
>  		RTE_MBUF_F_TX_L4_MASK |		 \
> --
> 2.25.1

[PATCH v2 0/2] check illegal packets

[Kevin Liu]

Check whether the data packet is illegal of ice and iavf driver.

v2:
Change the scheme, check the data_len and update commit log.

Kevin Liu (2):
  net/iavf: check illegal packets
  net/ice: check illegal packets

 drivers/net/iavf/iavf_rxtx.c |  9 +++++++++
 drivers/net/iavf/iavf_rxtx.h |  2 ++
 drivers/net/ice/ice_rxtx.c   | 11 +++++++++++
 drivers/net/ice/ice_rxtx.h   |  2 ++
 4 files changed, 24 insertions(+)

-- 
2.25.1

[PATCH v2 1/2] net/iavf: check illegal packets

[Kevin Liu]

If the length of data_len in mbuf is less than 17 or
greater than the maximum frame size, it is illegal.

These illegal packets will lead to TX/RX hang and
can't recover automatically.

This patch check those illegal packets and protect
TX/RX from hanging.

Fixes: a2b29a7733ef ("net/avf: enable basic Rx Tx")
Signed-off-by: Kevin Liu <kevinx.liu@intel.com>
---
 drivers/net/iavf/iavf_rxtx.c | 9 +++++++++
 drivers/net/iavf/iavf_rxtx.h | 2 ++
 2 files changed, 11 insertions(+)

diff --git a/drivers/net/iavf/iavf_rxtx.c b/drivers/net/iavf/iavf_rxtx.c
index 3deabe1d7e..be34d6210b 100644
--- a/drivers/net/iavf/iavf_rxtx.c
+++ b/drivers/net/iavf/iavf_rxtx.c
@@ -2865,6 +2865,7 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 	struct rte_mbuf *m;
 	struct iavf_tx_queue *txq = tx_queue;
 	struct rte_eth_dev *dev = &rte_eth_devices[txq->port_id];
+	uint16_t max_frame_size = dev->data->mtu + IAVF_ETH_OVERHEAD;
 	struct iavf_info *vf = IAVF_DEV_PRIVATE_TO_VF(dev->data->dev_private);
 	struct iavf_adapter *adapter = IAVF_DEV_PRIVATE_TO_ADAPTER(dev->data->dev_private);
 
@@ -2893,6 +2894,14 @@ iavf_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 			return i;
 		}
 
+		/* check the data_len in mbuf */
+		if (m->data_len < IAVF_TX_MIN_PKT_LEN ||
+			m->data_len > max_frame_size) {
+			rte_errno = EINVAL;
+			PMD_DRV_LOG(ERR, "INVALID mbuf: bad data_len=[%hu]", m->data_len);
+			return i;
+		}
+
 #ifdef RTE_ETHDEV_DEBUG_TX
 		ret = rte_validate_tx_offload(m);
 		if (ret != 0) {
diff --git a/drivers/net/iavf/iavf_rxtx.h b/drivers/net/iavf/iavf_rxtx.h
index 1695e43cd5..bb9083c699 100644
--- a/drivers/net/iavf/iavf_rxtx.h
+++ b/drivers/net/iavf/iavf_rxtx.h
@@ -53,6 +53,8 @@
 #define IAVF_TSO_MAX_SEG          UINT8_MAX
 #define IAVF_TX_MAX_MTU_SEG       8
 
+#define IAVF_TX_MIN_PKT_LEN 17
+
 #define IAVF_TX_CKSUM_OFFLOAD_MASK (		 \
 		RTE_MBUF_F_TX_IP_CKSUM |		 \
 		RTE_MBUF_F_TX_L4_MASK |		 \
-- 
2.25.1

[PATCH v2 2/2] net/ice: check illegal packets

[Kevin Liu]

If the length of data_len in mbuf is less than 17 or
greater than the maximum frame size, it is illegal.

These illegal packets will lead to TX/RX hang and
can't recover automatically.

This patch check those illegal packets and protect
TX/RX from hanging.

Fixes: 17c7d0f9d6a4 ("net/ice: support basic Rx/Tx")
Signed-off-by: Kevin Liu <kevinx.liu@intel.com>
---
 drivers/net/ice/ice_rxtx.c | 11 +++++++++++
 drivers/net/ice/ice_rxtx.h |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/drivers/net/ice/ice_rxtx.c b/drivers/net/ice/ice_rxtx.c
index 5af7c0c8f6..d1e1fadf9d 100644
--- a/drivers/net/ice/ice_rxtx.c
+++ b/drivers/net/ice/ice_rxtx.c
@@ -3442,6 +3442,9 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 	int i, ret;
 	uint64_t ol_flags;
 	struct rte_mbuf *m;
+	struct ice_tx_queue *txq = tx_queue;
+	struct rte_eth_dev *dev = &rte_eth_devices[txq->port_id];
+	uint16_t max_frame_size = dev->data->mtu + ICE_ETH_OVERHEAD;
 
 	for (i = 0; i < nb_pkts; i++) {
 		m = tx_pkts[i];
@@ -3458,6 +3461,14 @@ ice_prep_pkts(__rte_unused void *tx_queue, struct rte_mbuf **tx_pkts,
 			return i;
 		}
 
+		/* check the data_len in mbuf */
+		if (m->data_len < ICE_TX_MIN_PKT_LEN ||
+			m->data_len > max_frame_size) {
+			rte_errno = EINVAL;
+			PMD_DRV_LOG(ERR, "INVALID mbuf: bad data_len=[%hu]", m->data_len);
+			return i;
+		}
+
 #ifdef RTE_ETHDEV_DEBUG_TX
 		ret = rte_validate_tx_offload(m);
 		if (ret != 0) {
diff --git a/drivers/net/ice/ice_rxtx.h b/drivers/net/ice/ice_rxtx.h
index 6c08c175dc..e1d4fe8e47 100644
--- a/drivers/net/ice/ice_rxtx.h
+++ b/drivers/net/ice/ice_rxtx.h
@@ -40,6 +40,8 @@
 
 #define ICE_RXDID_COMMS_OVS	22
 
+#define ICE_TX_MIN_PKT_LEN 17
+
 extern uint64_t ice_timestamp_dynflag;
 extern int ice_timestamp_dynfield_offset;
 
-- 
2.25.1

RE: [PATCH v2 0/2] check illegal packets

[Zhang, Qi Z]

> -----Original Message-----
> From: Liu, KevinX <kevinx.liu@intel.com>
> Sent: Tuesday, September 27, 2022 3:15 PM
> To: dev@dpdk.org
> Cc: Yang, Qiming <qiming.yang@intel.com>; Zhang, Qi Z
> <qi.z.zhang@intel.com>; Yang, SteveX <stevex.yang@intel.com>; Xing, Beilei
> <beilei.xing@intel.com>; Wu, Jingjing <jingjing.wu@intel.com>; Liu, KevinX
> <kevinx.liu@intel.com>
> Subject: [PATCH v2 0/2] check illegal packets
> 
> Check whether the data packet is illegal of ice and iavf driver.
> 
> v2:
> Change the scheme, check the data_len and update commit log.
> 
> Kevin Liu (2):
>   net/iavf: check illegal packets
>   net/ice: check illegal packets
> 
>  drivers/net/iavf/iavf_rxtx.c |  9 +++++++++  drivers/net/iavf/iavf_rxtx.h |  2
> ++
>  drivers/net/ice/ice_rxtx.c   | 11 +++++++++++
>  drivers/net/ice/ice_rxtx.h   |  2 ++
>  4 files changed, 24 insertions(+)
> 
> --
> 2.25.1

Acked-by: Qi Zhang <qi.z.zhang@intel.com>

Applied to dpdk-next-net-intel.

Thanks
Qi

Re: [PATCH v2 0/2] check illegal packets

[David Marchand]

On Tue, Sep 27, 2022 at 9:24 AM Kevin Liu <kevinx.liu@intel.com> wrote:
>
> Check whether the data packet is illegal of ice and iavf driver.
>
> v2:
> Change the scheme, check the data_len and update commit log.
>
> Kevin Liu (2):
>   net/iavf: check illegal packets
>   net/ice: check illegal packets
>
>  drivers/net/iavf/iavf_rxtx.c |  9 +++++++++
>  drivers/net/iavf/iavf_rxtx.h |  2 ++
>  drivers/net/ice/ice_rxtx.c   | 11 +++++++++++
>  drivers/net/ice/ice_rxtx.h   |  2 ++
>  4 files changed, 24 insertions(+)

This series looks wrong to me.

- What happens if the application requests TSO to the nic?
- Checking data_len of a mbuf means only checking the size of the
first segment, so if any limitation applies to the packet size, it
should by checking pkt_len.

I will probably send reverts for the two patches.


-- 
David Marchand

Re: [PATCH v2 0/2] check illegal packets

[Kevin Traynor]

On 18/09/2023 15:42, David Marchand wrote:
> On Tue, Sep 27, 2022 at 9:24 AM Kevin Liu <kevinx.liu@intel.com> wrote:
>>
>> Check whether the data packet is illegal of ice and iavf driver.
>>
>> v2:
>> Change the scheme, check the data_len and update commit log.
>>
>> Kevin Liu (2):
>>    net/iavf: check illegal packets
>>    net/ice: check illegal packets
>>
>>   drivers/net/iavf/iavf_rxtx.c |  9 +++++++++
>>   drivers/net/iavf/iavf_rxtx.h |  2 ++
>>   drivers/net/ice/ice_rxtx.c   | 11 +++++++++++
>>   drivers/net/ice/ice_rxtx.h   |  2 ++
>>   4 files changed, 24 insertions(+)
> 
> This series looks wrong to me.
> 
> - What happens if the application requests TSO to the nic?
> - Checking data_len of a mbuf means only checking the size of the
> first segment, so if any limitation applies to the packet size, it
> should by checking pkt_len.
> 
> I will probably send reverts for the two patches.
> 
> 

there is a fix also that needs to be checked:
688cb2f2c61e ("net/ice: fix scalar Tx path segment")