[PATCH v3] net/mlx5: fix RSS expansion inner buffer overflow.

[PATCH v3] net/mlx5: fix RSS expansion inner buffer overflow.

[Maayan Kashani]

The stack which used for RSS expansion was overflowed and trashed RSS expansion data.
(buf->entry[MLX5_RSS_EXP_ELT_N]).
Due to this overflow, packets such as ARP or LACP with overwritten RSS types due to the
overflow will be dropped.

This increases the buffer size to avoid such overflows and adds relevant ASSERT for the future.

Bugzilla ID: 1173

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
Acked-by: Ori Kam <orika@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index cf83db7b60..41e298855b 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -374,7 +374,7 @@ mlx5_flow_expand_rss_skip_explicit(const struct mlx5_flow_expand_node graph[],
 	return next;
 }
 
-#define MLX5_RSS_EXP_ELT_N 16
+#define MLX5_RSS_EXP_ELT_N 32
 
 /**
  * Expand RSS flows into several possible flows according to the RSS hash
@@ -539,6 +539,7 @@ mlx5_flow_expand_rss(struct mlx5_flow_expand_rss *buf, size_t size,
 			if (lsize > size)
 				return -EINVAL;
 			n = elt * sizeof(*item);
+			MLX5_ASSERT((buf->entries) < MLX5_RSS_EXP_ELT_N);
 			buf->entry[buf->entries].priority =
 				stack_pos + 1 + missed;
 			buf->entry[buf->entries].pattern = addr;
-- 
2.25.1

RE: [PATCH v3] net/mlx5: fix RSS expansion inner buffer overflow.

[Raslan Darawsheh]

Hi,

> -----Original Message-----
> From: Maayan Kashani <mkashani@nvidia.com>
> Sent: Thursday, July 6, 2023 11:56 AM
> To: dev@dpdk.org
> Cc: Maayan Kashani <mkashani@nvidia.com>; Ori Kam <orika@nvidia.com>;
> Raslan Darawsheh <rasland@nvidia.com>; Matan Azrad
> <matan@nvidia.com>; Slava Ovsiienko <viacheslavo@nvidia.com>; Suanming
> Mou <suanmingm@nvidia.com>
> Subject: [PATCH v3] net/mlx5: fix RSS expansion inner buffer overflow.
> 
> The stack which used for RSS expansion was overflowed and trashed RSS
> expansion data.
[Raslan Darawsheh] line too long, wrap at 75 char will fix during integration 
> (buf->entry[MLX5_RSS_EXP_ELT_N]).
> Due to this overflow, packets such as ARP or LACP with overwritten RSS types
> due to the
> overflow will be dropped.
> 
> This increases the buffer size to avoid such overflows and adds relevant
> ASSERT for the future.
> 
> Bugzilla ID: 1173
> 
missing fixes tag and CC stable:
Fixes: 18ca4a4ec73a ("net/mlx5: support ESP SPI match and RSS hash")
    Cc: stable@dpdk.org
will fix during integration

missing:
Reported-by: Mário Kuka <kuka@cesnet.cz>
will fix during the integration

> Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
> Acked-by: Ori Kam <orika@nvidia.com>
> ---
Reviewed-by: Raslan Darawsheh <rasland@nvidia.com>

Patch applied to next-net-mlx,
Kindest regards
Raslan Darawsheh