From: Jakub Kicinski <kuba@xxxxxxxxxx>
commit 2b91cc1214b165c25ac9b0885db89a0d3224028a upstream.
The info.flow_type is for RXFH commands, ntuple flow_type is inside
the flow spec. The check currently does nothing, as info.flow_type
is 0 (or even uninitialized by user space) for ETHTOOL_SRXCLSRLINS.
Fixes: 9e43ad7a1ede ("net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts in")
Reviewed-by: Gal Pressman <gal@xxxxxxxxxx>
Reviewed-by: Joe Damato <jdamato@xxxxxxxxxx>
Link: https://patch.msgid.link/20250201013040.725123-3-kuba@xxxxxxxxxx
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/ethtool/ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -993,7 +993,7 @@ static noinline_for_stack int ethtool_se
return rc;
/* Nonzero ring with RSS only makes sense if NIC adds them together */
- if (cmd == ETHTOOL_SRXCLSRLINS && info.flow_type & FLOW_RSS &&
+ if (cmd == ETHTOOL_SRXCLSRLINS && info.fs.flow_type & FLOW_RSS &&
!ops->cap_rss_rxnfc_adds &&
ethtool_get_flow_spec_ring(info.fs.ring_cookie))
return -EINVAL;
Patches currently in stable-queue which might be from kuba@xxxxxxxxxx are
queue-6.12/net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch
queue-6.12/net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch
queue-6.12/bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch
queue-6.12/net-netdevsim-try-to-close-udp-port-harness-races.patch
queue-6.12/ethtool-fix-access-to-uninitialized-fields-in-set-rxnfc-command.patch
queue-6.12/net-hns3-fix-oops-when-unload-drivers-paralleling.patch
queue-6.12/selftests-net-lib-openvswitch-extend-cflags-to-keep-.patch
queue-6.12/vxlan-fix-uninit-value-in-vxlan_vnifilter_dump.patch
queue-6.12/inetpeer-remove-create-argument-of-inet_getpeer_v-46.patch
queue-6.12/net_sched-sch_sfq-handle-bigger-packets.patch
queue-6.12/inet-ipmr-fix-data-races.patch
queue-6.12/mptcp-handle-fastopen-disconnect-correctly.patch
queue-6.12/net-avoid-race-between-device-unregistration-and-eth.patch
queue-6.12/net-xdp-disallow-attaching-device-bound-programs-in-.patch
queue-6.12/net-rose-prevent-integer-overflows-in-rose_setsockop.patch
queue-6.12/net-airoha-fix-error-path-in-airoha_probe.patch
queue-6.12/net-let-net.core.dev_weight-always-be-non-zero.patch
queue-6.12/net_sched-sch_sfq-don-t-allow-1-packet-limit.patch
queue-6.12/inetpeer-update-inetpeer-timestamp-in-inet_getpeer.patch
queue-6.12/mptcp-consolidate-suboption-status.patch
queue-6.12/ptr_ring-do-not-block-hard-interrupts-in-ptr_ring_re.patch
queue-6.12/tools-ynl-c-correct-reverse-decode-of-empty-attrs.patch
queue-6.12/vsock-allow-retrying-on-connect-failure.patch
queue-6.12/net-davicom-fix-uaf-in-dm9000_drv_remove.patch
queue-6.12/net-mlx5-hws-fix-definer-s-hws_set32-macro-for-negat.patch
queue-6.12/inetpeer-do-not-get-a-refcount-in-inet_getpeer.patch
queue-6.12/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch
queue-6.12/tcp-correct-handling-of-extreme-memory-squeeze.patch
queue-6.12/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch
queue-6.12/net-rose-fix-timer-races-against-user-threads.patch
queue-6.12/octeon_ep_vf-remove-firmware-stats-fetch-in-ndo_get_.patch
queue-6.12/net-airoha-fix-wrong-gdm4-register-definition.patch
queue-6.12/net-ethtool-only-allow-set_rxnfc-with-rss-ring_cooki.patch
queue-6.12/inetpeer-remove-create-argument-of-inet_getpeer.patch
queue-6.12/net-sched-disallow-replacing-of-child-qdisc-from-one.patch
queue-6.12/rxrpc-fix-handling-of-received-connection-abort.patch
queue-6.12/rxrpc-afs-fix-peer-hash-locking-vs-rcu-callback.patch
queue-6.12/mptcp-pm-only-set-fullmesh-for-subflow-endp.patch
queue-6.12/revert-sunrpc-reduce-thread-wake-up-rate-when-receiving-large-rpc-messages.patch
queue-6.12/ethtool-ntuple-fix-rss-ring_cookie-check.patch
queue-6.12/ax25-rcu-protect-dev-ax25_ptr.patch
queue-6.12/selftests-mptcp-extend-cflags-to-keep-options-from-e.patch
queue-6.12/octeon_ep-remove-firmware-stats-fetch-in-ndo_get_sta.patch
queue-6.12/dev-acquire-netdev_rename_lock-before-restoring-dev-.patch
