DPDK patches and discussions
 help / color / mirror / Atom feed
* [PATCH v3] net/mlx5: fix RSS expansion inner buffer overflow.
@ 2023-07-06  8:55 Maayan Kashani
  2023-07-06 10:58 ` Raslan Darawsheh
  0 siblings, 1 reply; 2+ messages in thread
From: Maayan Kashani @ 2023-07-06  8:55 UTC (permalink / raw)
  To: dev
  Cc: mkashani, orika, rasland, Matan Azrad, Viacheslav Ovsiienko,
	Suanming Mou

The stack which used for RSS expansion was overflowed and trashed RSS expansion data.
(buf->entry[MLX5_RSS_EXP_ELT_N]).
Due to this overflow, packets such as ARP or LACP with overwritten RSS types due to the
overflow will be dropped.

This increases the buffer size to avoid such overflows and adds relevant ASSERT for the future.

Bugzilla ID: 1173

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
Acked-by: Ori Kam <orika@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index cf83db7b60..41e298855b 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -374,7 +374,7 @@ mlx5_flow_expand_rss_skip_explicit(const struct mlx5_flow_expand_node graph[],
 	return next;
 }
 
-#define MLX5_RSS_EXP_ELT_N 16
+#define MLX5_RSS_EXP_ELT_N 32
 
 /**
  * Expand RSS flows into several possible flows according to the RSS hash
@@ -539,6 +539,7 @@ mlx5_flow_expand_rss(struct mlx5_flow_expand_rss *buf, size_t size,
 			if (lsize > size)
 				return -EINVAL;
 			n = elt * sizeof(*item);
+			MLX5_ASSERT((buf->entries) < MLX5_RSS_EXP_ELT_N);
 			buf->entry[buf->entries].priority =
 				stack_pos + 1 + missed;
 			buf->entry[buf->entries].pattern = addr;
-- 
2.25.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2023-07-06 10:58 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-06  8:55 [PATCH v3] net/mlx5: fix RSS expansion inner buffer overflow Maayan Kashani
2023-07-06 10:58 ` Raslan Darawsheh

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).