patches for DPDK stable branches
 help / color / mirror / Atom feed
* [PATCH 1/3] net/mlx5: fix setting flags to external RxQ
       [not found] <20220410092528.1001685-1-michaelba@nvidia.com>
@ 2022-04-10  9:25 ` Michael Baum
  2022-04-10  9:25 ` [PATCH 2/3] net/mlx5: fix reading invalid index in RxQ array Michael Baum
  1 sibling, 0 replies; 2+ messages in thread
From: Michael Baum @ 2022-04-10  9:25 UTC (permalink / raw)
  To: dev; +Cc: Matan Azrad, Raslan Darawsheh, Viacheslav Ovsiienko, stable

The flow_drv_rxq_flags_set sets the Rx queue flags (Mark/Flag and Tunnel
Ptypes) according to the device flow.

It tries to get the RxQ control structure to update its ptype. however,
external RxQs don't have control structure to update and it may cause a
crash.

This patch add check whether this Queue is external.

Fixes: 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")
Cc: stable@dpdk.org

Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 78cb38d42b..e7542afa80 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -1379,8 +1379,11 @@ flow_drv_rxq_flags_set(struct rte_eth_dev *dev,
 		return;
 	for (i = 0; i != ind_tbl->queues_n; ++i) {
 		int idx = ind_tbl->queues[i];
-		struct mlx5_rxq_ctrl *rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
+		struct mlx5_rxq_ctrl *rxq_ctrl;
 
+		if (mlx5_is_external_rxq(dev, idx))
+			continue;
+		rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
 		MLX5_ASSERT(rxq_ctrl != NULL);
 		if (rxq_ctrl == NULL)
 			continue;
@@ -1483,8 +1486,11 @@ flow_drv_rxq_flags_trim(struct rte_eth_dev *dev,
 	MLX5_ASSERT(dev->data->dev_started);
 	for (i = 0; i != ind_tbl->queues_n; ++i) {
 		int idx = ind_tbl->queues[i];
-		struct mlx5_rxq_ctrl *rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
+		struct mlx5_rxq_ctrl *rxq_ctrl;
 
+		if (mlx5_is_external_rxq(dev, idx))
+			continue;
+		rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
 		MLX5_ASSERT(rxq_ctrl != NULL);
 		if (rxq_ctrl == NULL)
 			continue;
-- 
2.25.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* [PATCH 2/3] net/mlx5: fix reading invalid index in RxQ array
       [not found] <20220410092528.1001685-1-michaelba@nvidia.com>
  2022-04-10  9:25 ` [PATCH 1/3] net/mlx5: fix setting flags to external RxQ Michael Baum
@ 2022-04-10  9:25 ` Michael Baum
  1 sibling, 0 replies; 2+ messages in thread
From: Michael Baum @ 2022-04-10  9:25 UTC (permalink / raw)
  To: dev; +Cc: Matan Azrad, Raslan Darawsheh, Viacheslav Ovsiienko, stable

The mlx5_rxq_get() function gets RxQ index and return RxQ priv
accordingly.

When it gets an invalid index, it accesses out of array bounds which
might cause undefined behavior.

This patch adds a check for invalid indexes before accessing to array.

Fixes: 0cedf34da78f ("net/mlx5: move Rx queue reference count")
Cc: stable@dpdk.org

Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
 drivers/net/mlx5/mlx5_rxq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index f16795bac3..d41834f46f 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2042,6 +2042,8 @@ mlx5_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
+	if (idx >= priv->rxqs_n)
+		return NULL;
 	MLX5_ASSERT(priv->rxq_privs != NULL);
 	return (*priv->rxq_privs)[idx];
 }
-- 
2.25.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2022-04-10  9:25 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <20220410092528.1001685-1-michaelba@nvidia.com>
2022-04-10  9:25 ` [PATCH 1/3] net/mlx5: fix setting flags to external RxQ Michael Baum
2022-04-10  9:25 ` [PATCH 2/3] net/mlx5: fix reading invalid index in RxQ array Michael Baum

patches for DPDK stable branches

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.dpdk.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ http://inbox.dpdk.org/stable \
		stable@dpdk.org
	public-inbox-index stable

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.dpdk.org/inbox.dpdk.stable


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git