Re: [PATCH net-next 06/10] net/sched: cls_flower: add enc_key_id mask

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] net/sched: cls_flower: 24-bit VNI mask truncation in
  fl_set_key() offload
--

commit 3a83a862ed7b57be4e00c4d6825ecaf80ce19865
Author: Alexandre Cassen <acassen@corp.free.fr>

net/sched: cls_flower: add enc_key_id mask

This commit adds TCA_FLOWER_KEY_ENC_KEY_ID_MASK so flower filters can match
tunnel keys with an optional 32-bit mask instead of only exact matches.

> diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
> index 23eba4a00a947..dd248a335402a 100644
> --- a/net/sched/cls_flower.c
> +++ b/net/sched/cls_flower.c

[ ... ]

> @@ -2110,7 +2111,7 @@ static int fl_set_key(struct net *net, struct nlattr *tca_opts,
>  	}
>  
>  	fl_set_key_val(tb, &key->enc_key_id.keyid, TCA_FLOWER_KEY_ENC_KEY_ID,
> -		       &mask->enc_key_id.keyid, TCA_FLOWER_UNSPEC,
> +		       &mask->enc_key_id.keyid, TCA_FLOWER_KEY_ENC_KEY_ID_MASK,
>  		       sizeof(key->enc_key_id.keyid));

[Severity: Medium]
Can a filter with a 24-bit key and a mask that only has bits 24..31 set (such
as enc_key_id 0x0/0xff000000) truncate the hardware VNI mask to zero in cxgb4
and mlx5?

Commit "cxgb4: flower: refuse a tunnel key wider than the VNI" and commit
"net/mlx5e: TC, refuse a tunnel key wider than the VNI" only check that
match.key->keyid fits in 24 bits, so key 0 with mask 0xff000000 passes
validation.  In cxgb4, truncating match.mask->keyid to the 24-bit fs->mask.vni
field yields 0 and skips setting encap_vld, programming a rule that matches
non-encapsulated traffic on the port:

drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c:cxgb4_process_flow_match() {
	...
		fs->val.vni = be32_to_cpu(match.key->keyid);
		fs->mask.vni = be32_to_cpu(match.mask->keyid);
		if (fs->mask.vni) {
			fs->val.encap_vld = 1;
			fs->mask.encap_vld = 1;
		}
	...
}

In mlx5e_tc_tun_parse_vxlan(), enc_keyid.mask->keyid is non-zero, so it
truncates the 24-bit vxlan_vni mask in misc_c to 0 while still setting
MLX5_MATCH_MISC_PARAMETERS in spec->match_criteria_enable.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109131039.959438-1-acassen@corp.free.fr?part=6