diff mbox series

[iwl-net] ice: Fix checking for unsupported keys on non-tunnel device

Message ID 20240409154543.8181-2-marcin.szycik@linux.intel.com (mailing list archive)
State Awaiting Upstream
Delegated to: Netdev Maintainers
Headers show
Series [iwl-net] ice: Fix checking for unsupported keys on non-tunnel device | expand

Checks

Context Check Description
netdev/series_format success Single patches do not need cover letters
netdev/tree_selection success Clearly marked for net
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag present in non-next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 942 this patch: 942
netdev/build_tools success No tools touched, skip
netdev/cc_maintainers fail 1 blamed authors not CCed: anthony.l.nguyen@intel.com; 5 maintainers not CCed: pabeni@redhat.com jesse.brandeburg@intel.com kuba@kernel.org edumazet@google.com anthony.l.nguyen@intel.com
netdev/build_clang success Errors and warnings before: 953 this patch: 953
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn success Errors and warnings before: 953 this patch: 953
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 11 lines checked
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 21 this patch: 21
netdev/source_inline success Was 0 now: 0
netdev/contest fail net-next-2024-04-09--18-00 (tests: 958)

Commit Message

Marcin Szycik April 9, 2024, 3:45 p.m. UTC
Add missing FLOW_DISSECTOR_KEY_ENC_* checks to TC flower filter parsing.
Without these checks, it would be possible to add filters with tunnel
options on non-tunnel devices. enc_* options are only valid for tunnel
devices.

Example:
  devlink dev eswitch set $PF1_PCI mode switchdev
  echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
  tc qdisc add dev $VF1_PR ingress
  ethtool -K $PF1 hw-tc-offload on
  tc filter add dev $VF1_PR ingress flower enc_ttl 12 skip_sw action drop

Fixes: 9e300987d4a8 ("ice: VXLAN and Geneve TC support")
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
---
 drivers/net/ethernet/intel/ice/ice_tc_lib.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Jacob Keller April 10, 2024, 12:05 a.m. UTC | #1
On 4/9/2024 8:45 AM, Marcin Szycik wrote:
> Add missing FLOW_DISSECTOR_KEY_ENC_* checks to TC flower filter parsing.
> Without these checks, it would be possible to add filters with tunnel
> options on non-tunnel devices. enc_* options are only valid for tunnel
> devices.
> 
> Example:
>   devlink dev eswitch set $PF1_PCI mode switchdev
>   echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
>   tc qdisc add dev $VF1_PR ingress
>   ethtool -K $PF1 hw-tc-offload on
>   tc filter add dev $VF1_PR ingress flower enc_ttl 12 skip_sw action drop
> 
> Fixes: 9e300987d4a8 ("ice: VXLAN and Geneve TC support")
> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
> Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

> ---
>  drivers/net/ethernet/intel/ice/ice_tc_lib.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> index f8df93e1a9de..b49aa6554024 100644
> --- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> @@ -1489,7 +1489,10 @@ ice_parse_cls_flower(struct net_device *filter_dev, struct ice_vsi *vsi,
>  		  (BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) |
>  		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |
>  		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_KEYID) |
> -		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS))) {
> +		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS) |
> +		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IP) |
> +		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_OPTS) |
> +		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_CONTROL))) {
>  		NL_SET_ERR_MSG_MOD(fltr->extack, "Tunnel key used, but device isn't a tunnel");
>  		return -EOPNOTSUPP;
>  	} else {
Buvaneswaran, Sujai April 12, 2024, 6:45 a.m. UTC | #2
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of
> Marcin Szycik
> Sent: Tuesday, April 9, 2024 9:16 PM
> To: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org; Marcin Szycik <marcin.szycik@linux.intel.com>;
> Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
> Subject: [Intel-wired-lan] [PATCH iwl-net] ice: Fix checking for unsupported
> keys on non-tunnel device
> 
> Add missing FLOW_DISSECTOR_KEY_ENC_* checks to TC flower filter parsing.
> Without these checks, it would be possible to add filters with tunnel options
> on non-tunnel devices. enc_* options are only valid for tunnel devices.
> 
> Example:
>   devlink dev eswitch set $PF1_PCI mode switchdev
>   echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
>   tc qdisc add dev $VF1_PR ingress
>   ethtool -K $PF1 hw-tc-offload on
>   tc filter add dev $VF1_PR ingress flower enc_ttl 12 skip_sw action drop
> 
> Fixes: 9e300987d4a8 ("ice: VXLAN and Geneve TC support")
> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
> Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
> ---
>  drivers/net/ethernet/intel/ice/ice_tc_lib.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@intel.com>
diff mbox series

Patch

diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
index f8df93e1a9de..b49aa6554024 100644
--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
@@ -1489,7 +1489,10 @@  ice_parse_cls_flower(struct net_device *filter_dev, struct ice_vsi *vsi,
 		  (BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) |
 		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |
 		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_KEYID) |
-		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS))) {
+		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS) |
+		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IP) |
+		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_OPTS) |
+		   BIT_ULL(FLOW_DISSECTOR_KEY_ENC_CONTROL))) {
 		NL_SET_ERR_MSG_MOD(fltr->extack, "Tunnel key used, but device isn't a tunnel");
 		return -EOPNOTSUPP;
 	} else {