From dd6eaddff7ded951486929458877f43fc2873c5b Mon Sep 17 00:00:00 2001 From: Moti Haimovsky Date: Thu, 2 Aug 2018 11:41:07 +0300 Subject: [PATCH] net/mlx5: fix RSS flow configuration crash This commit fixes a segmentation fault observed when configuring mlx5 with RSS flow rule containing invalid queues indices such as negative numbers, queue numbers bigger than the number Rx queues the PMD or has no queues at all. Fixes: 592f05b29a25 ("net/mlx5: add RSS flow action") Signed-off-by: Moti Haimovsky --- drivers/net/mlx5/mlx5_flow.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c index 6c3021abac..b7500ec9d6 100644 --- a/drivers/net/mlx5/mlx5_flow.c +++ b/drivers/net/mlx5/mlx5_flow.c @@ -2065,6 +2065,11 @@ mlx5_flow_action_rss(struct rte_eth_dev *dev, RTE_FLOW_ERROR_TYPE_ACTION_CONF, &rss->key_len, "RSS hash key too large"); + if (!rss->queue_num) + return rte_flow_error_set(error, ENOTSUP, + RTE_FLOW_ERROR_TYPE_ACTION_CONF, + rss, + "no queues were provided for RSS"); if (rss->queue_num > priv->config.ind_table_max_size) return rte_flow_error_set(error, ENOTSUP, RTE_FLOW_ERROR_TYPE_ACTION_CONF, @@ -2077,6 +2082,12 @@ mlx5_flow_action_rss(struct rte_eth_dev *dev, "some RSS protocols are not" " supported"); for (i = 0; i != rss->queue_num; ++i) { + if (rss->queue[i] >= priv->rxqs_n) + return rte_flow_error_set + (error, EINVAL, + RTE_FLOW_ERROR_TYPE_ACTION_CONF, + rss, + "queue index out of range"); if (!(*priv->rxqs)[rss->queue[i]]) return rte_flow_error_set (error, EINVAL, -- 2.20.1