From: Shani Peretz <shperetz@nvidia.com>
To: <dev@dpdk.org>
Cc: <rasland@nvidia.com>, Shani Peretz <shperetz@nvidia.com>,
<stable@dpdk.org>, Dariusz Sosnowski <dsosnowski@nvidia.com>,
"Viacheslav Ovsiienko" <viacheslavo@nvidia.com>,
Bing Zhao <bingz@nvidia.com>, Ori Kam <orika@nvidia.com>,
Suanming Mou <suanmingm@nvidia.com>,
Matan Azrad <matan@nvidia.com>,
Maayan Kashani <mkashani@nvidia.com>
Subject: [PATCH] net/mlx5: fix null dereference in modify header
Date: Sun, 16 Nov 2025 14:10:26 +0200 [thread overview]
Message-ID: <20251116121026.180707-1-shperetz@nvidia.com> (raw)
GCC analyzer identified a code path where acts->mhdr could be
NULL when dereferenced.
When modify header validation fails in mlx5_tbl_translate_modify_header(),
__flow_hw_action_template_destroy() sets acts->mhdr to NULL.
Add defensive NULL check in mlx5_tbl_ensure_shared_modify_header()
to prevent the dereference.
Bugzilla ID: 1521
Fixes: 12f2ed3f03c8 ("net/mlx5: set modify header as shared flow action")
Cc: stable@dpdk.org
Signed-off-by: Shani Peretz <shperetz@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
drivers/net/mlx5/mlx5_flow_hw.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 208f50fbfd..519bec8556 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -2335,9 +2335,10 @@ mlx5_tbl_translate_modify_header(struct rte_eth_dev *dev,
.sz = sizeof(struct mlx5_modification_cmd) * mhdr->mhdr_cmds_num
};
- if (flow_hw_validate_compiled_modify_field(dev, cfg, mhdr, error)) {
+ int ret = flow_hw_validate_compiled_modify_field(dev, cfg, mhdr, error);
+ if (ret) {
__flow_hw_action_template_destroy(dev, acts);
- return -rte_errno;
+ return ret;
}
acts->mhdr = mlx5_malloc(MLX5_MEM_ZERO, sizeof(*acts->mhdr),
0, SOCKET_ID_ANY);
@@ -2370,9 +2371,14 @@ mlx5_tbl_ensure_shared_modify_header(struct rte_eth_dev *dev,
const struct rte_flow_attr *attr = &table_attr->flow_attr;
enum mlx5dr_table_type tbl_type = get_mlx5dr_table_type(attr, table_attr->specialize,
unified_fdb);
- struct mlx5dr_action_mh_pattern pattern = {
- .sz = sizeof(struct mlx5_modification_cmd) * acts->mhdr->mhdr_cmds_num
- };
+ struct mlx5dr_action_mh_pattern pattern;
+
+ if (!acts->mhdr)
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,
+ "translate modify_header: mhdr is NULL");
+
+ pattern.sz = sizeof(struct mlx5_modification_cmd) * acts->mhdr->mhdr_cmds_num;
uint16_t mhdr_ix = acts->mhdr->pos;
uint32_t flags = mlx5_hw_act_flag[!!attr->group][tbl_type] | MLX5DR_ACTION_FLAG_SHARED;
--
2.43.0
reply other threads:[~2025-11-16 12:11 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251116121026.180707-1-shperetz@nvidia.com \
--to=shperetz@nvidia.com \
--cc=bingz@nvidia.com \
--cc=dev@dpdk.org \
--cc=dsosnowski@nvidia.com \
--cc=matan@nvidia.com \
--cc=mkashani@nvidia.com \
--cc=orika@nvidia.com \
--cc=rasland@nvidia.com \
--cc=stable@dpdk.org \
--cc=suanmingm@nvidia.com \
--cc=viacheslavo@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).