Re: [dpdk-stable] [PATCH v2 2/5] app/testpmd: fix RSS key length

["Li, Xiaoyun" <xiaoyun.li@intel.com>]

> -----Original Message-----
> From: Maxime Coquelin <maxime.coquelin@redhat.com>
> Sent: Wednesday, September 22, 2021 17:58
> To: dev@dpdk.org; Xia, Chenbo <chenbo.xia@intel.com>;
> amorenoz@redhat.com; david.marchand@redhat.com;
> andrew.rybchenko@oktetlabs.ru; Yigit, Ferruh <ferruh.yigit@intel.com>;
> michaelba@nvidia.com; viacheslavo@nvidia.com; Li, Xiaoyun
> <xiaoyun.li@intel.com>
> Cc: stable@dpdk.org; nelio.laranjeiro@6wind.com; yvugenfi@redhat.com;
> ybendito@redhat.com; Maxime Coquelin <maxime.coquelin@redhat.com>
> Subject: [PATCH v2 2/5] app/testpmd: fix RSS key length
> 
> port_rss_hash_key_update() initializes rss_conf with the RSS key configuration
> provided  by the user, but it calls
> rte_eth_dev_rss_hash_conf_get() before calling rte_eth_dev_rss_hash_update(),
> which overrides the parsed RSS config.
> 
> While the RSS key value is set again after, this is not the case of the key length. It
> could cause out of bounds access if the key length parsed is smaller than the one
> read from rte_eth_dev_rss_hash_conf_get().
> 
> This patch restores the key length before the
> rte_eth_dev_rss_hash_update() call to ensure the RSS key value/length pair is
> consistent.
> 
> Fixes: 8205e241b2b0 ("app/testpmd: add missing type to RSS hash commands")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
> ---
>  app/test-pmd/config.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/app/test-pmd/config.c b/app/test-pmd/config.c index
> 9c66329e96..611965769c 100644
> --- a/app/test-pmd/config.c
> +++ b/app/test-pmd/config.c
> @@ -2854,7 +2854,7 @@ port_rss_hash_key_update(portid_t port_id, char
> rss_type[], uint8_t *hash_key,
>  	unsigned int i;
> 
>  	rss_conf.rss_key = NULL;
> -	rss_conf.rss_key_len = hash_key_len;
> +	rss_conf.rss_key_len = 0;
>  	rss_conf.rss_hf = 0;
>  	for (i = 0; rss_type_table[i].str; i++) {
>  		if (!strcmp(rss_type_table[i].str, rss_type)) @@ -2863,6 +2863,7
> @@ port_rss_hash_key_update(portid_t port_id, char rss_type[], uint8_t
> *hash_key,
>  	diag = rte_eth_dev_rss_hash_conf_get(port_id, &rss_conf);
>  	if (diag == 0) {
>  		rss_conf.rss_key = hash_key;
> +		rss_conf.rss_key_len = hash_key_len;
>  		diag = rte_eth_dev_rss_hash_update(port_id, &rss_conf);
>  	}
>  	if (diag == 0)
> --
> 2.31.1

Acked-by: Xiaoyun Li <xiaoyun.li@intel.com>