> > rte_acl_build() doesn't check that for a RANGE field the low bound
> > (value) doesn't exceed the high bound (mask_range). Field types are
> > known only from the rte_acl_config passed to rte_acl_build(), so
> > rte_acl_add_rules() doesn't validate ranges. Such a rule is accepted,
> > and then:
> > - for a 1-byte field the build crashes with a NULL pointer
> > dereference in acl_gen_node();
> > - for a 2-byte field (e.g. port range 80..22) the build succeeds,
> > but the rule matches every value of the field instead of none.
> >
> > The check was done only for the legacy ipv4vlan rules
> > (acl_ipv4vlan_check_rule(), now in app/test). Validate RANGE fields
> > of all rules in acl_check_bld_param(), together with the rest of the
> > build parameters, and fail rte_acl_build() with -EINVAL.
> > Add a test case with the generic API.
> >
> > Fixes: dc276b5780c2 ("acl: new library")
> > Cc: [email protected]
> >
> > Signed-off-by: Andrey Mokrushin <[email protected]>
>
> Acked-by: Konstantin Ananyev <[email protected]>
Applied, thanks.
