github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: stmmac: fix l3l4 filter rejecting unsupported offload requests

Browse Source 
The basic flow parser in tc_add_basic_flow() does not validate match
keys before proceeding. Unsupported offload configurations such as
partial protocol masks, non-IPv4 network proto, or non-TCP/UDP transport
proto are silently accepted instead of returning -EOPNOTSUPP.

Add validation to return -EOPNOTSUPP early for:
- No network or transport proto present in the key
- Partial protocol mask (only full mask supported)
- Network proto is not IPv4
- Transport proto is not TCP or UDP

Each rejection includes an extack message so the user knows which part
of the match is unsupported.

Also propagate -EOPNOTSUPP from tc_add_basic_flow() in tc_add_flow()
by returning it directly rather than using break. The break was silently
discarding the error for FLOW_CLS_REPLACE operations where entry->in_use
is already true, causing tc_add_flow() to return 0 (success) for
unsupported replace requests.

Fixes: 425eabddaf ("net: stmmac: Implement L3/L4 Filters using TC Flower")
Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20260714023716.29865-4-muhammad.nazim.amirul.nazle.asmade@altera.com
Reviewed-by: Jakub Raczynski <j.raczynski@samsung.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Nazim Amirul 2026-07-13 19:37:15 -07:00 committed by Paolo Abeni
parent 9fcf274d93
commit 5536d7c843
1 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
View File

@ -446,6 +446,7 @@ static int tc_parse_flow_actions(struct stmmac_priv *priv,
}
#define ETHER_TYPE_FULL_MASK cpu_to_be16(~0)
#define IP_PROTO_FULL_MASK 0xFF
static int tc_add_basic_flow(struct stmmac_priv *priv,
struct flow_cls_offload *cls,
@ -461,6 +462,37 @@ static int tc_add_basic_flow(struct stmmac_priv *priv,
flow_rule_match_basic(rule, &match);
/* Both network proto and transport proto not present in the key */
if (!match.mask || !(match.mask->n_proto || match.mask->ip_proto)) {
NL_SET_ERR_MSG_MOD(cls->common.extack,
"filter must specify network or transport protocol");
return -EOPNOTSUPP;
}
/* If the proto is present in the key and is not full mask */
if ((match.mask->n_proto && match.mask->n_proto != ETHER_TYPE_FULL_MASK) ||
(match.mask->ip_proto && match.mask->ip_proto != IP_PROTO_FULL_MASK)) {
NL_SET_ERR_MSG_MOD(cls->common.extack,
"only full protocol mask is supported");
return -EOPNOTSUPP;
}
/* Network proto is present in the key and is not IPv4 */
if (match.mask->n_proto && match.key->n_proto != cpu_to_be16(ETH_P_IP)) {
NL_SET_ERR_MSG_MOD(cls->common.extack,
"only IPv4 network protocol is supported");
return -EOPNOTSUPP;
}
/* Transport proto is present in the key and is not TCP or UDP */
if (match.mask->ip_proto &&
match.key->ip_proto != IPPROTO_TCP &&
match.key->ip_proto != IPPROTO_UDP) {
NL_SET_ERR_MSG_MOD(cls->common.extack,
"only TCP and UDP transport protocols are supported");
return -EOPNOTSUPP;
}
entry->ip_proto = match.key->ip_proto;
return 0;
}
@ -598,6 +630,8 @@ static int tc_add_flow(struct stmmac_priv *priv,
ret = tc_flow_parsers[i].fn(priv, cls, entry);
if (!ret)
entry->in_use = true;
else if (ret == -EOPNOTSUPP)
return ret;
}
if (!entry->in_use)