net/mlx5: fix RSS flow action bounds check

The number of queues provided by the application is not checked against
parser's supported maximum.

Fixes: 3d821d6fea40 ("net/mlx5: support RSS action flow rule")
Cc: stable@dpdk.org
Signed-off-by: Adrien Mazarguil <adrien.mazarguil@6wind.com>
Acked-by: Nelio Laranjeiro <nelio.laranjeiro@6wind.com>
Acked-by: Ferruh Yigit <ferruh.yigit@intel.com>

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 7ef68de493d7b9d1ffdada6c3d12c9cedc7f7bf2..1ca413e325e221dd07c5aa1d908885e6ce17d659 100644 (file)
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -16,6 +16,7 @@
 #pragma GCC diagnostic error "-Wpedantic"
 #endif
 
+#include <rte_common.h>
 #include <rte_ethdev_driver.h>
 #include <rte_flow.h>
 #include <rte_flow_driver.h>
@@ -713,6 +714,14 @@ mlx5_flow_convert_actions(struct rte_eth_dev *dev,
                                        return -rte_errno;
                                }
                        }
+                       if (rss->num > RTE_DIM(parser->queues)) {
+                               rte_flow_error_set(error, EINVAL,
+                                                  RTE_FLOW_ERROR_TYPE_ACTION,
+                                                  actions,
+                                                  "too many queues for RSS"
+                                                  " context");
+                               return -rte_errno;
+                       }
                        for (n = 0; n < rss->num; ++n) {
                                if (rss->queue[n] >= priv->rxqs_n) {
                                        rte_flow_error_set(error, EINVAL,