* [PATCH 1/3] net/mlx5: fix setting flags to external RxQ
2022-04-10 9:25 [PATCH 0/3] net/mlx5: some RSS fixes Michael Baum
@ 2022-04-10 9:25 ` Michael Baum
2022-04-10 9:25 ` [PATCH 2/3] net/mlx5: fix reading invalid index in RxQ array Michael Baum
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Michael Baum @ 2022-04-10 9:25 UTC (permalink / raw)
To: dev; +Cc: Matan Azrad, Raslan Darawsheh, Viacheslav Ovsiienko, stable
The flow_drv_rxq_flags_set sets the Rx queue flags (Mark/Flag and Tunnel
Ptypes) according to the device flow.
It tries to get the RxQ control structure to update its ptype. however,
external RxQs don't have control structure to update and it may cause a
crash.
This patch add check whether this Queue is external.
Fixes: 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")
Cc: stable@dpdk.org
Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
drivers/net/mlx5/mlx5_flow.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 78cb38d42b..e7542afa80 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -1379,8 +1379,11 @@ flow_drv_rxq_flags_set(struct rte_eth_dev *dev,
return;
for (i = 0; i != ind_tbl->queues_n; ++i) {
int idx = ind_tbl->queues[i];
- struct mlx5_rxq_ctrl *rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
+ struct mlx5_rxq_ctrl *rxq_ctrl;
+ if (mlx5_is_external_rxq(dev, idx))
+ continue;
+ rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
MLX5_ASSERT(rxq_ctrl != NULL);
if (rxq_ctrl == NULL)
continue;
@@ -1483,8 +1486,11 @@ flow_drv_rxq_flags_trim(struct rte_eth_dev *dev,
MLX5_ASSERT(dev->data->dev_started);
for (i = 0; i != ind_tbl->queues_n; ++i) {
int idx = ind_tbl->queues[i];
- struct mlx5_rxq_ctrl *rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
+ struct mlx5_rxq_ctrl *rxq_ctrl;
+ if (mlx5_is_external_rxq(dev, idx))
+ continue;
+ rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
MLX5_ASSERT(rxq_ctrl != NULL);
if (rxq_ctrl == NULL)
continue;
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 2/3] net/mlx5: fix reading invalid index in RxQ array
2022-04-10 9:25 [PATCH 0/3] net/mlx5: some RSS fixes Michael Baum
2022-04-10 9:25 ` [PATCH 1/3] net/mlx5: fix setting flags to external RxQ Michael Baum
@ 2022-04-10 9:25 ` Michael Baum
2022-04-10 9:25 ` [PATCH 3/3] net/mlx5: optimize Rx is hairpin function Michael Baum
2022-04-14 7:35 ` [PATCH 0/3] net/mlx5: some RSS fixes Raslan Darawsheh
3 siblings, 0 replies; 5+ messages in thread
From: Michael Baum @ 2022-04-10 9:25 UTC (permalink / raw)
To: dev; +Cc: Matan Azrad, Raslan Darawsheh, Viacheslav Ovsiienko, stable
The mlx5_rxq_get() function gets RxQ index and return RxQ priv
accordingly.
When it gets an invalid index, it accesses out of array bounds which
might cause undefined behavior.
This patch adds a check for invalid indexes before accessing to array.
Fixes: 0cedf34da78f ("net/mlx5: move Rx queue reference count")
Cc: stable@dpdk.org
Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
drivers/net/mlx5/mlx5_rxq.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index f16795bac3..d41834f46f 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2042,6 +2042,8 @@ mlx5_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
{
struct mlx5_priv *priv = dev->data->dev_private;
+ if (idx >= priv->rxqs_n)
+ return NULL;
MLX5_ASSERT(priv->rxq_privs != NULL);
return (*priv->rxq_privs)[idx];
}
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 3/3] net/mlx5: optimize Rx is hairpin function
2022-04-10 9:25 [PATCH 0/3] net/mlx5: some RSS fixes Michael Baum
2022-04-10 9:25 ` [PATCH 1/3] net/mlx5: fix setting flags to external RxQ Michael Baum
2022-04-10 9:25 ` [PATCH 2/3] net/mlx5: fix reading invalid index in RxQ array Michael Baum
@ 2022-04-10 9:25 ` Michael Baum
2022-04-14 7:35 ` [PATCH 0/3] net/mlx5: some RSS fixes Raslan Darawsheh
3 siblings, 0 replies; 5+ messages in thread
From: Michael Baum @ 2022-04-10 9:25 UTC (permalink / raw)
To: dev; +Cc: Matan Azrad, Raslan Darawsheh, Viacheslav Ovsiienko
The mlx5_rxq_is_hairpin() function checks whether RxQ type is Hairpin.
It is done by reading a flag in Rx control structure coming from
mlx5_rxq_ctrl_get() function.
The function verifies that the queue index is valid even though it has
been checked within the mlx5_rxq_ctrl_get() function.
This patch removes the redundant check.
Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
drivers/net/mlx5/mlx5_rxq.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index d41834f46f..1782d52f71 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2332,13 +2332,12 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
bool
mlx5_rxq_is_hairpin(struct rte_eth_dev *dev, uint16_t idx)
{
- struct mlx5_priv *priv = dev->data->dev_private;
struct mlx5_rxq_ctrl *rxq_ctrl;
if (mlx5_is_external_rxq(dev, idx))
return false;
rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
- return (idx < priv->rxqs_n && rxq_ctrl != NULL && rxq_ctrl->is_hairpin);
+ return (rxq_ctrl != NULL && rxq_ctrl->is_hairpin);
}
/*
@@ -2355,9 +2354,12 @@ mlx5_rxq_is_hairpin(struct rte_eth_dev *dev, uint16_t idx)
const struct rte_eth_hairpin_conf *
mlx5_rxq_get_hairpin_conf(struct rte_eth_dev *dev, uint16_t idx)
{
- struct mlx5_rxq_priv *rxq = mlx5_rxq_get(dev, idx);
+ if (mlx5_rxq_is_hairpin(dev, idx)) {
+ struct mlx5_rxq_priv *rxq = mlx5_rxq_get(dev, idx);
- return mlx5_rxq_is_hairpin(dev, idx) ? &rxq->hairpin_conf : NULL;
+ return rxq != NULL ? &rxq->hairpin_conf : NULL;
+ }
+ return NULL;
}
/**
@@ -2367,7 +2369,7 @@ mlx5_rxq_get_hairpin_conf(struct rte_eth_dev *dev, uint16_t idx)
* @param ind_tbl
* Pointer to indirection table to match.
* @param queues
- * Queues to match to ques in indirection table.
+ * Queues to match to queues in indirection table.
* @param queues_n
* Number of queues in the array.
*
@@ -2376,11 +2378,11 @@ mlx5_rxq_get_hairpin_conf(struct rte_eth_dev *dev, uint16_t idx)
*/
static int
mlx5_ind_table_obj_match_queues(const struct mlx5_ind_table_obj *ind_tbl,
- const uint16_t *queues, uint32_t queues_n)
+ const uint16_t *queues, uint32_t queues_n)
{
- return (ind_tbl->queues_n == queues_n) &&
- (!memcmp(ind_tbl->queues, queues,
- ind_tbl->queues_n * sizeof(ind_tbl->queues[0])));
+ return (ind_tbl->queues_n == queues_n) &&
+ (!memcmp(ind_tbl->queues, queues,
+ ind_tbl->queues_n * sizeof(ind_tbl->queues[0])));
}
/**
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread* RE: [PATCH 0/3] net/mlx5: some RSS fixes
2022-04-10 9:25 [PATCH 0/3] net/mlx5: some RSS fixes Michael Baum
` (2 preceding siblings ...)
2022-04-10 9:25 ` [PATCH 3/3] net/mlx5: optimize Rx is hairpin function Michael Baum
@ 2022-04-14 7:35 ` Raslan Darawsheh
3 siblings, 0 replies; 5+ messages in thread
From: Raslan Darawsheh @ 2022-04-14 7:35 UTC (permalink / raw)
To: Michael Baum, dev; +Cc: Matan Azrad, Slava Ovsiienko
Hi,
> -----Original Message-----
> From: Michael Baum <michaelba@nvidia.com>
> Sent: Sunday, April 10, 2022 12:25 PM
> To: dev@dpdk.org
> Cc: Matan Azrad <matan@nvidia.com>; Raslan Darawsheh
> <rasland@nvidia.com>; Slava Ovsiienko <viacheslavo@nvidia.com>
> Subject: [PATCH 0/3] net/mlx5: some RSS fixes
>
> Some RxQ management fixes affecting RSS flow rules.
>
> Michael Baum (3):
> net/mlx5: fix setting flags to external RxQ
> net/mlx5: fix reading invalid index in RxQ array
> net/mlx5: optimize Rx is hairpin function
>
> drivers/net/mlx5/mlx5_flow.c | 10 ++++++++--
> drivers/net/mlx5/mlx5_rxq.c | 22 +++++++++++++---------
> 2 files changed, 21 insertions(+), 11 deletions(-)
>
> --
> 2.25.1
Series applied to next-net-mlx,
Kindest regards,
Raslan Darawsheh
^ permalink raw reply [flat|nested] 5+ messages in thread