Re: [PATCH] net/mlx5: fix crash when using meter in transfer flow

[Dariusz Sosnowski <dsosnowski@nvidia.com>]

+ mlx5 maintainers

Thank you for the patch.

On Wed, Jul 02, 2025 at 08:36:17AM -0400, Khadem Ullah wrote:
> When creating a flow rule with the transfer attribute and a meter action,
> the driver did not validate this combination and would crash due to
> unsupported handling.
> 
> This patch adds explicit validation rejecting meter action in transfer
> flows with an appropriate error message.
> 
> Fixes: 46a5e6bc6a85 ("net/mlx5: prepare meter flow tables")
> Cc: stable@dpdk.org
> 
> Steps to reproduce:
> 1. Launch testpmd:
>    ./build/app/dpdk-testpmd -l 0,1 -a <PCI BDF> -- -i --rxq=8 --txq=8
> 
> 2. Inside testpmd:
>    add port meter profile trtcm_rfc2698 0 0 5 10 50 100 1
>    add port meter policy 0 0 g_actions mark id 3 / queue index 2 / end /
>       y_actions mark id 7 / queue index 3 / end r_actions drop / end
>    create port meter 0 0 0 0 yes 0xffff 0 y 0
> 3. flow create 0 group 0 ingress pattern eth / ipv4 / end actions
>      jump group 1 / end
> 3. Following causes a segmentation fault:
>    flow create 0 transfer ingress pattern eth / ipv4 /
>       end actions meter mtr_id 0 / end

I tried these steps on v25.07-rc3 and the segfault does not reproduce for me.
rte_flow_create() correctly returns ENOTSUP for that case.

Similar case was segfaulting recently,
but it was fixed by this commit: https://github.com/DPDK/dpdk/commit/c30b356a4d48542fe99c47aa470afc8cd1ced9f5
This specific fix is available from v25.03 and is included in v24.11.2

On other LTSes - v22.11.8 and v23.11.4 - segfault does not reproduce
for me as well. Either ENOTSUP or validation error is reported.

Which DPDK version are you using?

I see that the flow rule is created with transfer attribute.
Are you using a setup with switchdev enabled?
(https://docs.kernel.org/networking/device_drivers/ethernet/mellanox/mlx5/switchdev.html)

> 
> This patch ensures proper handling of the meter action with
> transfer rule to prevent this crash.
> 
> Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
> ---
>  drivers/net/mlx5/mlx5_flow.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
> index 8db372123c..a7b793ef29 100644
> --- a/drivers/net/mlx5/mlx5_flow.c
> +++ b/drivers/net/mlx5/mlx5_flow.c
> @@ -7993,7 +7993,17 @@ mlx5_flow_create(struct rte_eth_dev *dev,
>  	struct rte_flow_attr *new_attr = (void *)(uintptr_t)attr;
>  	uint32_t prio = attr->priority;
>  	uintptr_t flow_idx;
> -
> +	if (attr && attr->transfer) {
> +		const struct rte_flow_action *act;
> +		for (act = actions; act && act->type != RTE_FLOW_ACTION_TYPE_END; ++act) {
> +			if (act->type == RTE_FLOW_ACTION_TYPE_METER) {
> +				rte_flow_error_set(error, ENOTSUP,
> +					RTE_FLOW_ERROR_TYPE_ACTION, act,
> +					"Meter action is not supported in transfer flows");
> +				return NULL;
> +			}
> +		}
> +	}
>  	/*
>  	 * If the device is not started yet, it is not allowed to created a
>  	 * flow from application. PMD default flows and traffic control flows
> -- 
> 2.43.0
> 

Best regards,
Dariusz Sosnowski