[PATCH 2/2] net/nfp: fix incorrect queue index

[Chaoyong He <chaoyong.he@corigine.com>]

From: Long Wu <long.wu@corigine.com>

When user adds a queue flow rule with incorrect queue index,
the rule can be added successfully but the packets are not
directed to the queue. The reason is that queue action does
not check validity of queue index in driver.

Add code to check queue index in queue action.

Fixes: 7493f8a527cc ("net/nfp: support queue flow action")
Cc: Chaoyong He <chaoyong.he@corigine.com>
Cc: stable@dpdk.org

Signed-off-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
 drivers/net/nfp/nfp_net_flow.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index bd983aaf6a..ff6ce3ee45 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -564,8 +564,9 @@ nfp_net_flow_action_mark(struct rte_flow *nfp_flow,
 	action_data->mark_id = mark->id;
 }
 
-static void
-nfp_net_flow_action_queue(struct rte_flow *nfp_flow,
+static int
+nfp_net_flow_action_queue(struct rte_eth_dev *dev,
+		struct rte_flow *nfp_flow,
 		const struct rte_flow_action *action)
 {
 	struct nfp_net_cmsg_action *action_data;
@@ -573,15 +574,24 @@ nfp_net_flow_action_queue(struct rte_flow *nfp_flow,
 
 	action_data = (struct nfp_net_cmsg_action *)nfp_flow->payload.action_data;
 	queue = action->conf;
+	if (queue->index >= dev->data->nb_rx_queues ||
+			dev->data->rx_queues[queue->index] == NULL) {
+		PMD_DRV_LOG(ERR, "Queue index is illegal");
+		return -EINVAL;
+	}
 
 	action_data->action |= NFP_NET_CMSG_ACTION_QUEUE;
 	action_data->queue = queue->index;
+
+	return 0;
 }
 
 static int
-nfp_net_flow_compile_actions(const struct rte_flow_action actions[],
+nfp_net_flow_compile_actions(struct rte_eth_dev *dev,
+		const struct rte_flow_action actions[],
 		struct rte_flow *nfp_flow)
 {
+	int ret = 0;
 	const struct rte_flow_action *action;
 
 	for (action = actions; action->type != RTE_FLOW_ACTION_TYPE_END; ++action) {
@@ -596,7 +606,7 @@ nfp_net_flow_compile_actions(const struct rte_flow_action actions[],
 			break;
 		case RTE_FLOW_ACTION_TYPE_QUEUE:
 			PMD_DRV_LOG(DEBUG, "Process RTE_FLOW_ACTION_TYPE_QUEUE");
-			nfp_net_flow_action_queue(nfp_flow, action);
+			ret = nfp_net_flow_action_queue(dev, nfp_flow, action);
 			break;
 		default:
 			PMD_DRV_LOG(ERR, "Unsupported action type: %d", action->type);
@@ -604,7 +614,7 @@ nfp_net_flow_compile_actions(const struct rte_flow_action actions[],
 		}
 	}
 
-	return 0;
+	return ret;
 }
 
 static void
@@ -670,7 +680,7 @@ nfp_net_flow_setup(struct rte_eth_dev *dev,
 		goto free_flow;
 	}
 
-	ret = nfp_net_flow_compile_actions(actions, nfp_flow);
+	ret = nfp_net_flow_compile_actions(dev, actions, nfp_flow);
 	if (ret != 0) {
 		PMD_DRV_LOG(ERR, "NFP flow action process failed.");
 		goto free_flow;
-- 
2.39.1