[PATCH 0/3] net/mlx5: some RSS fixes

[PATCH 0/3] net/mlx5: some RSS fixes

[Michael Baum]

Some RxQ management fixes affecting RSS flow rules.

Michael Baum (3):
  net/mlx5: fix setting flags to external RxQ
  net/mlx5: fix reading invalid index in RxQ array
  net/mlx5: optimize Rx is hairpin function

 drivers/net/mlx5/mlx5_flow.c | 10 ++++++++--
 drivers/net/mlx5/mlx5_rxq.c  | 22 +++++++++++++---------
 2 files changed, 21 insertions(+), 11 deletions(-)

-- 
2.25.1

[PATCH 1/3] net/mlx5: fix setting flags to external RxQ

[Michael Baum]

The flow_drv_rxq_flags_set sets the Rx queue flags (Mark/Flag and Tunnel
Ptypes) according to the device flow.

It tries to get the RxQ control structure to update its ptype. however,
external RxQs don't have control structure to update and it may cause a
crash.

This patch add check whether this Queue is external.

Fixes: 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")
Cc: stable@dpdk.org

Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index 78cb38d42b..e7542afa80 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -1379,8 +1379,11 @@ flow_drv_rxq_flags_set(struct rte_eth_dev *dev,
 		return;
 	for (i = 0; i != ind_tbl->queues_n; ++i) {
 		int idx = ind_tbl->queues[i];
-		struct mlx5_rxq_ctrl *rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
+		struct mlx5_rxq_ctrl *rxq_ctrl;
 
+		if (mlx5_is_external_rxq(dev, idx))
+			continue;
+		rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
 		MLX5_ASSERT(rxq_ctrl != NULL);
 		if (rxq_ctrl == NULL)
 			continue;
@@ -1483,8 +1486,11 @@ flow_drv_rxq_flags_trim(struct rte_eth_dev *dev,
 	MLX5_ASSERT(dev->data->dev_started);
 	for (i = 0; i != ind_tbl->queues_n; ++i) {
 		int idx = ind_tbl->queues[i];
-		struct mlx5_rxq_ctrl *rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
+		struct mlx5_rxq_ctrl *rxq_ctrl;
 
+		if (mlx5_is_external_rxq(dev, idx))
+			continue;
+		rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
 		MLX5_ASSERT(rxq_ctrl != NULL);
 		if (rxq_ctrl == NULL)
 			continue;
-- 
2.25.1

[PATCH 2/3] net/mlx5: fix reading invalid index in RxQ array

[Michael Baum]

The mlx5_rxq_get() function gets RxQ index and return RxQ priv
accordingly.

When it gets an invalid index, it accesses out of array bounds which
might cause undefined behavior.

This patch adds a check for invalid indexes before accessing to array.

Fixes: 0cedf34da78f ("net/mlx5: move Rx queue reference count")
Cc: stable@dpdk.org

Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
 drivers/net/mlx5/mlx5_rxq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index f16795bac3..d41834f46f 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2042,6 +2042,8 @@ mlx5_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
+	if (idx >= priv->rxqs_n)
+		return NULL;
 	MLX5_ASSERT(priv->rxq_privs != NULL);
 	return (*priv->rxq_privs)[idx];
 }
-- 
2.25.1

[PATCH 3/3] net/mlx5: optimize Rx is hairpin function

[Michael Baum]

The mlx5_rxq_is_hairpin() function checks whether RxQ type is Hairpin.
It is done by reading a flag in Rx control structure coming from
mlx5_rxq_ctrl_get() function.

The function verifies that the queue index is valid even though it has
been checked within the mlx5_rxq_ctrl_get() function.

This patch removes the redundant check.

Signed-off-by: Michael Baum <michaelba@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
 drivers/net/mlx5/mlx5_rxq.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index d41834f46f..1782d52f71 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2332,13 +2332,12 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 bool
 mlx5_rxq_is_hairpin(struct rte_eth_dev *dev, uint16_t idx)
 {
-	struct mlx5_priv *priv = dev->data->dev_private;
 	struct mlx5_rxq_ctrl *rxq_ctrl;
 
 	if (mlx5_is_external_rxq(dev, idx))
 		return false;
 	rxq_ctrl = mlx5_rxq_ctrl_get(dev, idx);
-	return (idx < priv->rxqs_n && rxq_ctrl != NULL && rxq_ctrl->is_hairpin);
+	return (rxq_ctrl != NULL && rxq_ctrl->is_hairpin);
 }
 
 /*
@@ -2355,9 +2354,12 @@ mlx5_rxq_is_hairpin(struct rte_eth_dev *dev, uint16_t idx)
 const struct rte_eth_hairpin_conf *
 mlx5_rxq_get_hairpin_conf(struct rte_eth_dev *dev, uint16_t idx)
 {
-	struct mlx5_rxq_priv *rxq = mlx5_rxq_get(dev, idx);
+	if (mlx5_rxq_is_hairpin(dev, idx)) {
+		struct mlx5_rxq_priv *rxq = mlx5_rxq_get(dev, idx);
 
-	return mlx5_rxq_is_hairpin(dev, idx) ? &rxq->hairpin_conf : NULL;
+		return rxq != NULL ? &rxq->hairpin_conf : NULL;
+	}
+	return NULL;
 }
 
 /**
@@ -2367,7 +2369,7 @@ mlx5_rxq_get_hairpin_conf(struct rte_eth_dev *dev, uint16_t idx)
  * @param ind_tbl
  *   Pointer to indirection table to match.
  * @param queues
- *   Queues to match to ques in indirection table.
+ *   Queues to match to queues in indirection table.
  * @param queues_n
  *   Number of queues in the array.
  *
@@ -2376,11 +2378,11 @@ mlx5_rxq_get_hairpin_conf(struct rte_eth_dev *dev, uint16_t idx)
  */
 static int
 mlx5_ind_table_obj_match_queues(const struct mlx5_ind_table_obj *ind_tbl,
-		       const uint16_t *queues, uint32_t queues_n)
+				const uint16_t *queues, uint32_t queues_n)
 {
-		return (ind_tbl->queues_n == queues_n) &&
-		    (!memcmp(ind_tbl->queues, queues,
-			    ind_tbl->queues_n * sizeof(ind_tbl->queues[0])));
+	return (ind_tbl->queues_n == queues_n) &&
+		(!memcmp(ind_tbl->queues, queues,
+			 ind_tbl->queues_n * sizeof(ind_tbl->queues[0])));
 }
 
 /**
-- 
2.25.1

RE: [PATCH 0/3] net/mlx5: some RSS fixes

[Raslan Darawsheh]

Hi,

> -----Original Message-----
> From: Michael Baum <michaelba@nvidia.com>
> Sent: Sunday, April 10, 2022 12:25 PM
> To: dev@dpdk.org
> Cc: Matan Azrad <matan@nvidia.com>; Raslan Darawsheh
> <rasland@nvidia.com>; Slava Ovsiienko <viacheslavo@nvidia.com>
> Subject: [PATCH 0/3] net/mlx5: some RSS fixes
> 
> Some RxQ management fixes affecting RSS flow rules.
> 
> Michael Baum (3):
>   net/mlx5: fix setting flags to external RxQ
>   net/mlx5: fix reading invalid index in RxQ array
>   net/mlx5: optimize Rx is hairpin function
> 
>  drivers/net/mlx5/mlx5_flow.c | 10 ++++++++--
>  drivers/net/mlx5/mlx5_rxq.c  | 22 +++++++++++++---------
>  2 files changed, 21 insertions(+), 11 deletions(-)
> 
> --
> 2.25.1

Series applied to next-net-mlx,

Kindest regards,
Raslan Darawsheh