Re: [PATCH] net/mlx5: fix crash when using meter in transfer flow

[Dariusz Sosnowski <dsosnowski@nvidia.com>]

On Tue, Jul 15, 2025 at 07:39:53PM +0200, Dariusz Sosnowski wrote:
> + mlx5 maintainers
> 
> Thank you for the patch.
> 
> On Wed, Jul 02, 2025 at 08:36:17AM -0400, Khadem Ullah wrote:
> > When creating a flow rule with the transfer attribute and a meter action,
> > the driver did not validate this combination and would crash due to
> > unsupported handling.
> > 
> > This patch adds explicit validation rejecting meter action in transfer
> > flows with an appropriate error message.
> > 
> > Fixes: 46a5e6bc6a85 ("net/mlx5: prepare meter flow tables")
> > Cc: stable@dpdk.org
> > 
> > Steps to reproduce:
> > 1. Launch testpmd:
> >    ./build/app/dpdk-testpmd -l 0,1 -a <PCI BDF> -- -i --rxq=8 --txq=8
> > 
> > 2. Inside testpmd:
> >    add port meter profile trtcm_rfc2698 0 0 5 10 50 100 1
> >    add port meter policy 0 0 g_actions mark id 3 / queue index 2 / end /
> >       y_actions mark id 7 / queue index 3 / end r_actions drop / end
> >    create port meter 0 0 0 0 yes 0xffff 0 y 0
> > 3. flow create 0 group 0 ingress pattern eth / ipv4 / end actions
> >      jump group 1 / end
> > 3. Following causes a segmentation fault:
> >    flow create 0 transfer ingress pattern eth / ipv4 /
> >       end actions meter mtr_id 0 / end
> 
> I tried these steps on v25.07-rc3 and the segfault does not reproduce for me.
> rte_flow_create() correctly returns ENOTSUP for that case.
> 
> Similar case was segfaulting recently,
> but it was fixed by this commit: https://github.com/DPDK/dpdk/commit/c30b356a4d48542fe99c47aa470afc8cd1ced9f5
> This specific fix is available from v25.03 and is included in v24.11.2
> 
> On other LTSes - v22.11.8 and v23.11.4 - segfault does not reproduce
> for me as well. Either ENOTSUP or validation error is reported.
> 
> Which DPDK version are you using?
> 
> I see that the flow rule is created with transfer attribute.
> Are you using a setup with switchdev enabled?
> (https://docs.kernel.org/networking/device_drivers/ethernet/mellanox/mlx5/switchdev.html)
> 

Also, for wider context:

- If switchdev is not enabled, then creating transfer flow
  rules is not allowed.
  Without switchdev enabled, mlx5 PMD cannot control
  the embedded switch of the NIC, so no transfer flow rules can be created.
  This is the reason for current behavior of returning ENOTSUP on main branch.

- If switchdev is enabled, transfer flow rules are allowed.
  There are however 2 important points:

  - Transfer attribute cannot be mixed with either ingress or egress.
    (https://doc.dpdk.org/guides/prog_guide/ethdev/flow_offload.html#attribute-transfer)
  - In default configuration, mlx5 PMD does not support QUEUE actions for transfer flow rules.
    In the steps above, meter policy contains QUEUE actions, so using
    such meter in transfer rules is not allowed and is rejected by the driver.