[PATCH] net/mlx5: fix null dereference in modify header

[PATCH] net/mlx5: fix null dereference in modify header

[Shani Peretz]

GCC analyzer identified a code path where acts->mhdr could be
NULL when dereferenced.
When modify header validation fails in mlx5_tbl_translate_modify_header(),
 __flow_hw_action_template_destroy() sets acts->mhdr to NULL.
Add defensive NULL check in mlx5_tbl_ensure_shared_modify_header()
to prevent the dereference.

Bugzilla ID: 1521
Fixes: 12f2ed3f03c8 ("net/mlx5: set modify header as shared flow action")
Cc: stable@dpdk.org

Signed-off-by: Shani Peretz <shperetz@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow_hw.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 208f50fbfd..519bec8556 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -2335,9 +2335,10 @@ mlx5_tbl_translate_modify_header(struct rte_eth_dev *dev,
 		.sz = sizeof(struct mlx5_modification_cmd) * mhdr->mhdr_cmds_num
 	};
 
-	if (flow_hw_validate_compiled_modify_field(dev, cfg, mhdr, error)) {
+	int ret = flow_hw_validate_compiled_modify_field(dev, cfg, mhdr, error);
+	if (ret) {
 		__flow_hw_action_template_destroy(dev, acts);
-		return -rte_errno;
+		return ret;
 	}
 	acts->mhdr = mlx5_malloc(MLX5_MEM_ZERO, sizeof(*acts->mhdr),
 				 0, SOCKET_ID_ANY);
@@ -2370,9 +2371,14 @@ mlx5_tbl_ensure_shared_modify_header(struct rte_eth_dev *dev,
 	const struct rte_flow_attr *attr = &table_attr->flow_attr;
 	enum mlx5dr_table_type tbl_type = get_mlx5dr_table_type(attr, table_attr->specialize,
 								unified_fdb);
-	struct mlx5dr_action_mh_pattern pattern = {
-		.sz = sizeof(struct mlx5_modification_cmd) * acts->mhdr->mhdr_cmds_num
-	};
+	struct mlx5dr_action_mh_pattern pattern;
+
+	if (!acts->mhdr)
+		return rte_flow_error_set(error, EINVAL,
+						RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,
+						"translate modify_header: mhdr is NULL");
+
+	pattern.sz = sizeof(struct mlx5_modification_cmd) * acts->mhdr->mhdr_cmds_num;
 	uint16_t mhdr_ix = acts->mhdr->pos;
 	uint32_t flags = mlx5_hw_act_flag[!!attr->group][tbl_type] | MLX5DR_ACTION_FLAG_SHARED;
 
-- 
2.43.0