| Message ID | 20240417135131.99921-1-ast@fiberby.net (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4713744d9f6ee1f6dc5ac6f58c30f1b9f21067f8 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] mlxsw: spectrum_flower: validate control flags | expand |
Asbjørn Sloth Tønnesen <ast@fiberby.net> writes: > This driver currently doesn't support any control flags. > > Use flow_rule_has_control_flags() to check for control flags, > such as can be set through `tc flower ... ip_flags frag`. > > In case any control flags are masked, flow_rule_has_control_flags() > sets a NL extended error message, and we return -EOPNOTSUPP. > > Only compile-tested. > > Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net> Thanks, I'll take this through our regression.
On Wed, Apr 17, 2024 at 01:51:20PM +0000, Asbjørn Sloth Tønnesen wrote: > This driver currently doesn't support any control flags. > > Use flow_rule_has_control_flags() to check for control flags, > such as can be set through `tc flower ... ip_flags frag`. > > In case any control flags are masked, flow_rule_has_control_flags() > sets a NL extended error message, and we return -EOPNOTSUPP. > > Only compile-tested. > > Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Tested-by: Ido Schimmel <idosch@nvidia.com> Without patch: + tc qdisc add dev swp1 clsact + tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags frag action drop + tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags nofrag action drop + tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags firstfrag action drop + tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags nofirstfrag action drop With patch: + tc qdisc add dev swp1 clsact + tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags frag action drop Error: mlxsw_spectrum: Unsupported match on control.flags 0x1. We have an error talking to the kernel + tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags nofrag action drop Error: mlxsw_spectrum: Unsupported match on control.flags 0x1. We have an error talking to the kernel + tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags firstfrag action drop Error: mlxsw_spectrum: Unsupported match on control.flags 0x2. We have an error talking to the kernel + tc filter add dev swp1 ingress pref 1 proto ip flower skip_sw ip_flags nofirstfrag action drop Error: mlxsw_spectrum: Unsupported match on control.flags 0x2. We have an error talking to the kernel Thanks!
Petr Machata <petrm@nvidia.com> writes: > Asbjørn Sloth Tønnesen <ast@fiberby.net> writes: > >> This driver currently doesn't support any control flags. >> >> Use flow_rule_has_control_flags() to check for control flags, >> such as can be set through `tc flower ... ip_flags frag`. >> >> In case any control flags are masked, flow_rule_has_control_flags() >> sets a NL extended error message, and we return -EOPNOTSUPP. >> >> Only compile-tested. >> >> Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net> > > Thanks, I'll take this through our regression. Nothing bombed. Tested-by: Petr Machata <petrm@nvidia.com>
Hello: This patch was applied to netdev/net-next.git (main) by Jakub Kicinski <kuba@kernel.org>: On Wed, 17 Apr 2024 13:51:20 +0000 you wrote: > This driver currently doesn't support any control flags. > > Use flow_rule_has_control_flags() to check for control flags, > such as can be set through `tc flower ... ip_flags frag`. > > In case any control flags are masked, flow_rule_has_control_flags() > sets a NL extended error message, and we return -EOPNOTSUPP. > > [...] Here is the summary with links: - [net-next] mlxsw: spectrum_flower: validate control flags https://git.kernel.org/netdev/net-next/c/4713744d9f6e You are awesome, thank you!
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c index 9fd1ca079258..f07955b5439f 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c @@ -595,6 +595,10 @@ static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp, flow_rule_match_control(rule, &match); addr_type = match.key->addr_type; + + if (flow_rule_has_control_flags(match.mask->flags, + f->common.extack)) + return -EOPNOTSUPP; } if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
This driver currently doesn't support any control flags. Use flow_rule_has_control_flags() to check for control flags, such as can be set through `tc flower ... ip_flags frag`. In case any control flags are masked, flow_rule_has_control_flags() sets a NL extended error message, and we return -EOPNOTSUPP. Only compile-tested. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net> --- drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 4 ++++ 1 file changed, 4 insertions(+)