From 4599a6179ab28eaa44e6a53b48463b6535f71be5 Mon Sep 17 00:00:00 2001 From: Ivan Malov Date: Tue, 11 Jan 2022 00:48:45 +0300 Subject: [PATCH] net/sfc: validate queue span when parsing flow action RSS [ upstream commit 667151aec1ddf8669819ac39d3e86f40f815c213 ] The current code silently shrinks the value if it exceeds the supported maximum. Do not do that. Validate the value. Fixes: d77d07391d4d ("net/sfc: support flow API RSS action") Signed-off-by: Ivan Malov Reviewed-by: Andrew Rybchenko --- drivers/net/sfc/sfc_flow.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/sfc/sfc_flow.c b/drivers/net/sfc/sfc_flow.c index fc74c8035e..509fde4a86 100644 --- a/drivers/net/sfc/sfc_flow.c +++ b/drivers/net/sfc/sfc_flow.c @@ -1477,6 +1477,9 @@ sfc_flow_parse_rss(struct sfc_adapter *sa, rxq_hw_index_max = rxq->hw_index; } + if (rxq_hw_index_max - rxq_hw_index_min + 1 > EFX_MAXRSS) + return -EINVAL; + switch (action_rss->func) { case RTE_ETH_HASH_FUNCTION_DEFAULT: case RTE_ETH_HASH_FUNCTION_TOEPLITZ: @@ -1612,9 +1615,8 @@ sfc_flow_filter_insert(struct sfc_adapter *sa, uint8_t *rss_key; if (spec_filter->rss) { - rss_spread = MIN(flow_rss->rxq_hw_index_max - - flow_rss->rxq_hw_index_min + 1, - EFX_MAXRSS); + rss_spread = flow_rss->rxq_hw_index_max - + flow_rss->rxq_hw_index_min + 1; rss_hash_types = flow_rss->rss_hash_types; rss_key = flow_rss->rss_key; } else {