VXLAN and GENEVE rules shift the key and the mask of enc_key_id into a 24
bit VNI. An exact key above bit 23 already selects the wrong VNI. Flower
is about to accept partial masks. A mask that only covers bits above 23
would then match any VNI. Refuse a key that no VNI can match. GRE keeps
its 32 bit key.
Found by an AI code review agent while auditing the users of enc_key_id.
Build tested only.
Signed-off-by: Alexandre Cassen <redacted>
---
.../ethernet/netronome/nfp/flower/offload.c | 21 +++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index 161190200dbd..e5f6f4f464ad 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -150,6 +150,23 @@ static bool nfp_flower_check_higher_than_l3(struct flow_rule *rule)
flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ICMP);
}
+static int
+nfp_flower_check_tun_vni(struct flow_rule *rule,
+ struct netlink_ext_ack *extack)
+{
+ struct flow_match_enc_keyid enc_keyid;
+
+ if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_KEYID))
+ return 0;
+
+ flow_rule_match_enc_keyid(rule, &enc_keyid);
+ if (be32_to_cpu(enc_keyid.key->keyid) < VXLAN_N_VID)
+ return 0;
+
+ NL_SET_ERR_MSG_MOD(extack, "unsupported offload: tunnel key does not fit the 24 bit VNI");
+ return -EOPNOTSUPP;
+}
+
static int
nfp_flower_calc_opt_layer(struct flow_dissector_key_enc_opts *enc_opts,
u32 *key_layer_two, int *key_size, bool ipv6,@@ -411,6 +428,10 @@ nfp_flower_calculate_key_layers(struct nfp_app *app,
NL_SET_ERR_MSG_MOD(extack, "unsupported offload: ingress netdev does not match the expected tunnel type");
return -EOPNOTSUPP;
}
+
+ err = nfp_flower_check_tun_vni(rule, extack);
+ if (err)
+ return err;
}
}
--
2.43.0