net/mlx5: fix RSS flow configuration crash

This commit fixes a segmentation fault observed when configuring
mlx5 with RSS flow rule containing invalid queues indices such as
negative numbers, queue numbers bigger than the number Rx queues the
PMD or has no queues at all.

Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action")
Signed-off-by: Moti Haimovsky <motih@mellanox.com>

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 6c3021abac5c3bcbe07415175739246d2ce00f7f..b7500ec9d6ce67e4f9cde416b26fb41ac0ff8bd6 100644 (file)
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -2065,6 +2065,11 @@ mlx5_flow_action_rss(struct rte_eth_dev *dev,
                                          RTE_FLOW_ERROR_TYPE_ACTION_CONF,
                                          &rss->key_len,
                                          "RSS hash key too large");
+       if (!rss->queue_num)
+               return rte_flow_error_set(error, ENOTSUP,
+                                         RTE_FLOW_ERROR_TYPE_ACTION_CONF,
+                                         rss,
+                                         "no queues were provided for RSS");
        if (rss->queue_num > priv->config.ind_table_max_size)
                return rte_flow_error_set(error, ENOTSUP,
                                          RTE_FLOW_ERROR_TYPE_ACTION_CONF,
@@ -2077,6 +2082,12 @@ mlx5_flow_action_rss(struct rte_eth_dev *dev,
                                          "some RSS protocols are not"
                                          " supported");
        for (i = 0; i != rss->queue_num; ++i) {
+               if (rss->queue[i] >= priv->rxqs_n)
+                       return rte_flow_error_set
+                               (error, EINVAL,
+                                RTE_FLOW_ERROR_TYPE_ACTION_CONF,
+                                rss,
+                                "queue index out of range");
                if (!(*priv->rxqs)[rss->queue[i]])
                        return rte_flow_error_set
                                (error, EINVAL,