On 4/9/2024 8:45 AM, Marcin Szycik wrote:
> Add missing FLOW_DISSECTOR_KEY_ENC_* checks to TC flower filter parsing.
> Without these checks, it would be possible to add filters with tunnel
> options on non-tunnel devices. enc_* options are only valid for tunnel
> devices.
>
> Example:
> devlink dev eswitch set $PF1_PCI mode switchdev
> echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
> tc qdisc add dev $VF1_PR ingress
> ethtool -K $PF1 hw-tc-offload on
> tc filter add dev $VF1_PR ingress flower enc_ttl 12 skip_sw action drop
>
> Fixes: 9e300987d4a8 ("ice: VXLAN and Geneve TC support")
> Reviewed-by: Michal Swiatkowski <[email protected]>
> Signed-off-by: Marcin Szycik <[email protected]>
Reviewed-by: Jacob Keller <[email protected]>
> ---
> drivers/net/ethernet/intel/ice/ice_tc_lib.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> index f8df93e1a9de..b49aa6554024 100644
> --- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> +++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
> @@ -1489,7 +1489,10 @@ ice_parse_cls_flower(struct net_device *filter_dev,
> struct ice_vsi *vsi,
> (BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) |
> BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |
> BIT_ULL(FLOW_DISSECTOR_KEY_ENC_KEYID) |
> - BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS))) {
> + BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS) |
> + BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IP) |
> + BIT_ULL(FLOW_DISSECTOR_KEY_ENC_OPTS) |
> + BIT_ULL(FLOW_DISSECTOR_KEY_ENC_CONTROL))) {
> NL_SET_ERR_MSG_MOD(fltr->extack, "Tunnel key used, but device
> isn't a tunnel");
> return -EOPNOTSUPP;
> } else {
