From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7923A46AD4 for ; Wed, 2 Jul 2025 17:32:48 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 6FAA44028E; Wed, 2 Jul 2025 17:32:48 +0200 (CEST) Received: from mail-qv1-f52.google.com (mail-qv1-f52.google.com [209.85.219.52]) by mails.dpdk.org (Postfix) with ESMTP id 0312B4028E for ; Wed, 2 Jul 2025 17:32:47 +0200 (CEST) Received: by mail-qv1-f52.google.com with SMTP id 6a1803df08f44-6fac7147cb8so114963046d6.1 for ; Wed, 02 Jul 2025 08:32:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uetpeshawar-edu-pk.20230601.gappssmtp.com; s=20230601; t=1751470367; x=1752075167; darn=dpdk.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=ZmTzqkMq80IlKer6iz0QkFrC/tGA/3a5tGEYRX1ro2A=; b=OdkIB2dvCO49FGkwvYhZXbgadm+eiN0LM1QLeZuVQUV+lgAZwmZhT+NcRzf1A3UCgL BJhkNAmClAyQ8x2ZLK5xPQ+eOS4Umc85o/vlnp5WhfdqCnnFw7cQM3jDU1sBMjqzxSxb 4Q2h4cVmRHWkXU/nOhfQapDH9RxOvC2+/Fn2bM2M8yxXs7TD8ukpzneui2X0sDzmLkd1 fP2THv31nQcaPoB96Gm/QnTpUR2JxQYXr/88OQuDDXhjxEGCaRKU8luYVqDtO4iTUwiD RliyAkKemZltcZwNERoSBgdB3gg2BAe8OGO2t40Kzqrj439mI6wWZ6IXh1C9bUNULliw V74g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1751470367; x=1752075167; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=ZmTzqkMq80IlKer6iz0QkFrC/tGA/3a5tGEYRX1ro2A=; b=a+YTm66OguKJqKRsZ4bK3Z3ifER2sPcRwjeknRiaKurouI7chC4SjVhHDKxmZXqVP/ TnNpvkgBaBWViSRrAOa5PoQeRA/RDZWn0V/nq05imWQlQipybdpXEyDiXzZHLqOQbYMo aABTI2AgApdlwOekuAxxRrGOb1op9ikjiVLyh0g9XTcOz3b0Zu5hHfl1r12q4Uc0Gfpf OI+JeQShDHBqOWC4c5PdkkcI1m7P7HhVybcy5s9gDtmbZ1hZrIXppXsWHf62E/2uRoDh FZ8lZnwFN3tRN9lMNuvHYYSyKgvPbwNMA1WKVTjPednGaxlhCoyCYtLJsufCkGEiJ+kS Qv4A== X-Forwarded-Encrypted: i=1; AJvYcCVLS5c00A8EKuwxg79PZamHytW+c486/pcE9w7XkTG0YzZXLYIphW6V+cXaKqf7/Sn4jmkfE7s=@dpdk.org X-Gm-Message-State: AOJu0YwzmjmXSg77lAMhr+xtXyc/VUShlp0ilFn9gfF3rStwkfnhBKGB h2We6QsKl6y++Y1a20FlZiCIlv0sSiFdSiCsX0qV/4WUqW6Y6P9wrTM0e9D/67ZxYi6xWcIpFKC 0oIEe4cpmqOkCdRu/EW8VuXq4Sn2gXdBq6mZ+74PIGA== X-Gm-Gg: ASbGncsDr/T1ZfKfgj5VF7PkcIV5bxXZt2qMb075RoXrnSOf4SGeSEgKwNp+/Fsuj+G v6BhtJr8yjWBfUVO4cSYr2lsiX9i5kJ/UYxH+HSZHuZW4WofRGCXKHJ38TOztaqs3xMdNd7f/sB 4uXJFtUgFAPDXIa/PitpkzVGlFPxVlUyCQyDc4p8/mASv1ZBlmBOPpYlwJwI/LFgfZNynZbjp9o ura X-Google-Smtp-Source: AGHT+IEXHz9cBFbYqmecQhGnhgX0JiqIc5skn3UQrvdTVGaAFWPrU06pVhYukmxnSL0hZ3j6QfkofUZQI7cLPIt7B8A= X-Received: by 2002:a05:6214:2029:b0:6fd:616a:1ab4 with SMTP id 6a1803df08f44-702b170d129mr46413686d6.0.1751470367005; Wed, 02 Jul 2025 08:32:47 -0700 (PDT) MIME-Version: 1.0 References: <20250612210733.2506558-72-luca.boccassi@gmail.com> <20250630122556.1133654-1-luca.boccassi@gmail.com> <20250630122556.1133654-2-luca.boccassi@gmail.com> In-Reply-To: <20250630122556.1133654-2-luca.boccassi@gmail.com> From: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk> Date: Wed, 2 Jul 2025 20:32:33 +0500 X-Gm-Features: Ac12FXzS2kKnIO52JV2tw9MctGmoIvbzMg7_nLKwaU1DyeTQ0GtBnsXXrtpxjiU Message-ID: Subject: Re: patch 'net/mlx5: fix crash on age query with indirect conntrack' has been queued to stable release 22.11.9 To: luca.boccassi@gmail.com Cc: Dariusz Sosnowski , dpdk stable Content-Type: multipart/alternative; boundary="0000000000000f73750638f3f912" X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org --0000000000000f73750638f3f912 Content-Type: text/plain; charset="UTF-8" Hi Luca Boccassi I think the page is still in queue. Please apply it to dpdk-stable. Regards, Khadem On Mon, Jun 30, 2025, 17:26 wrote: > Hi, > > FYI, your patch has been queued to stable release 22.11.9 > > Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. > It will be pushed if I get no objections before 07/02/25. So please > shout if anyone has objections. > > Also note that after the patch there's a diff of the upstream commit vs the > patch applied to the branch. This will indicate if there was any rebasing > needed to apply to the stable branch. If there were code changes for > rebasing > (ie: not only metadata diffs), please double check that the rebase was > correctly done. > > Queued patches are on a temporary branch at: > https://github.com/bluca/dpdk-stable > > This queued commit can be viewed at: > > https://github.com/bluca/dpdk-stable/commit/ab74ac87bc7fe0554e3a2e0e6c94558647b9770d > > Thanks. > > Luca Boccassi > > --- > From ab74ac87bc7fe0554e3a2e0e6c94558647b9770d Mon Sep 17 00:00:00 2001 > From: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk> > Date: Thu, 26 Jun 2025 09:07:02 -0400 > Subject: [PATCH] net/mlx5: fix crash on age query with indirect conntrack > > [ upstream commit 3bb6e3bf05284f0668e2ac14ce4b90a2909dff99 ] > > This patch fixes a segmentation fault that occurs when querying the > AGE action of a flow rule that uses indirect connection tracking (CT). > > Background: > AGE and CT indices share a union in the mlx5 flow struct. When using CT > without age, the age index is invalid. Querying AGE in this case leads > to a crash due to reading an invalid pointer. > > Solution: > Add a check in `flow_dv_query()` to prevent AGE queries on indirect CT > actions. This is the correct fix rather than null-checking the pool. > > Steps to reproduce: > 1. Create an indirect CT action: > flow indirect_action 0 create ingress action conntrack / end > > 2. Create a root rule with jump: > flow create 0 ingress pattern eth / ipv4 / tcp / end actions jump > group 3 / end > > 3. Create a group 3 rule using the indirect action: > flow create 0 group 3 ingress pattern eth / ipv4 / tcp / end actions > indirect 0 / jump group 5 / end > > 4. Create a group 5 rule matching CT state: > flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is > 1 / end actions queue index 5 / end > > 5. Querying the first rule causes segfault: > flow query 0 1 age > > Fixes: 2d084f69aa26 ("net/mlx5: add translation of connection tracking > action") > > Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk> > Acked-by: Dariusz Sosnowski > --- > .mailmap | 1 + > drivers/net/mlx5/mlx5_flow_dv.c | 5 +++++ > 2 files changed, 6 insertions(+) > > diff --git a/.mailmap b/.mailmap > index 7e6ada5733..9a89b1a12e 100644 > --- a/.mailmap > +++ b/.mailmap > @@ -736,6 +736,7 @@ Kevin Scott > Kevin Traynor > Ke Xu > Ke Zhang > +Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk> > Khoa To > Kiran KN > Kiran Kumar K > diff --git a/drivers/net/mlx5/mlx5_flow_dv.c > b/drivers/net/mlx5/mlx5_flow_dv.c > index d11e39431f..f3a76f9e93 100644 > --- a/drivers/net/mlx5/mlx5_flow_dv.c > +++ b/drivers/net/mlx5/mlx5_flow_dv.c > @@ -16950,6 +16950,11 @@ flow_dv_query(struct rte_eth_dev *dev, > error); > break; > case RTE_FLOW_ACTION_TYPE_AGE: > + if (flow->indirect_type == > MLX5_INDIRECT_ACTION_TYPE_CT) > + return rte_flow_error_set(error, ENOTSUP, > + > RTE_FLOW_ERROR_TYPE_ACTION, > + actions, > + "age not available"); > ret = flow_dv_query_age(dev, flow, data, error); > break; > default: > -- > 2.47.2 > > --- > Diff of the applied patch vs upstream commit (please double-check if > non-empty: > --- > --- - 2025-06-30 13:21:21.850344929 +0100 > +++ 0002-net-mlx5-fix-crash-on-age-query-with-indirect-conntr.patch > 2025-06-30 13:21:21.739057181 +0100 > @@ -1 +1 @@ > -From 3bb6e3bf05284f0668e2ac14ce4b90a2909dff99 Mon Sep 17 00:00:00 2001 > +From ab74ac87bc7fe0554e3a2e0e6c94558647b9770d Mon Sep 17 00:00:00 2001 > @@ -5,0 +6,2 @@ > +[ upstream commit 3bb6e3bf05284f0668e2ac14ce4b90a2909dff99 ] > + > @@ -35 +36,0 @@ > -Cc: stable@dpdk.org > @@ -45 +46 @@ > -index 8483d96ec5..6126f7e472 100644 > +index 7e6ada5733..9a89b1a12e 100644 > @@ -48 +49 @@ > -@@ -812,6 +812,7 @@ Kevin Scott > +@@ -736,6 +736,7 @@ Kevin Scott > @@ -55 +56 @@ > - Kiran Kumar K < > kkokkilagadda@caviumnetworks.com> > + Kiran Kumar K > @@ -57 +58 @@ > -index d555a9cdcb..7b9e5018b8 100644 > +index d11e39431f..f3a76f9e93 100644 > @@ -60 +61 @@ > -@@ -18146,6 +18146,11 @@ flow_dv_query(struct rte_eth_dev *dev, > +@@ -16950,6 +16950,11 @@ flow_dv_query(struct rte_eth_dev *dev, > --0000000000000f73750638f3f912 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Luca Boccassi=C2=A0

I think the page is still in queue. Please apply it t= o dpdk-stable.=C2=A0

Regards,=C2=A0
Khadem=C2=A0

On Mon, Jun 3= 0, 2025, 17:26 <luca.boccass= i@gmail.com> wrote:
Hi,

FYI, your patch has been queued to stable release 22.11.9

Note it hasn't been pushed to http://dpdk.org/brows= e/dpdk-stable yet.
It will be pushed if I get no objections before 07/02/25. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs= the
patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasi= ng
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https= ://github.com/bluca/dpdk-stable/commit/ab74ac87bc7fe0554e3a2e0e6c94558647b9= 770d

Thanks.

Luca Boccassi

---
>From ab74ac87bc7fe0554e3a2e0e6c94558647b9770d Mon Sep 17 00:00:00 2001
From: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk> Date: Thu, 26 Jun 2025 09:07:02 -0400
Subject: [PATCH] net/mlx5: fix crash on age query with indirect conntrack
[ upstream commit 3bb6e3bf05284f0668e2ac14ce4b90a2909dff99 ]

This patch fixes a segmentation fault that occurs when querying the
AGE action of a flow rule that uses indirect connection tracking (CT).

Background:
AGE and CT indices share a union in the mlx5 flow struct. When using CT
without age, the age index is invalid. Querying AGE in this case leads
to a crash due to reading an invalid pointer.

Solution:
Add a check in `flow_dv_query()` to prevent AGE queries on indirect CT
actions. This is the correct fix rather than null-checking the pool.

Steps to reproduce:
=C2=A01. Create an indirect CT action:
=C2=A0 =C2=A0 flow indirect_action 0 create ingress action conntrack / end<= br>
=C2=A02. Create a root rule with jump:
=C2=A0 =C2=A0 flow create 0 ingress pattern eth / ipv4 / tcp / end actions = jump group 3 / end

=C2=A03. Create a group 3 rule using the indirect action:
=C2=A0 =C2=A0 flow create 0 group 3 ingress pattern eth / ipv4 / tcp / end = actions indirect 0 / jump group 5 / end

=C2=A04. Create a group 5 rule matching CT state:
=C2=A0 =C2=A0 flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conn= track is 1 / end actions queue index 5 / end

=C2=A05. Querying the first rule causes segfault:
=C2=A0 =C2=A0 flow query 0 1 age

Fixes: 2d084f69aa26 ("net/mlx5: add translation of connection tracking= action")

Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk<= /a>>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
=C2=A0.mailmap=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 | 1 +
=C2=A0drivers/net/mlx5/mlx5_flow_dv.c | 5 +++++
=C2=A02 files changed, 6 insertions(+)

diff --git a/.mailmap b/.mailmap
index 7e6ada5733..9a89b1a12e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -736,6 +736,7 @@ Kevin Scott <kevin.c.scott@intel.com> =C2=A0Kevin Traynor <ktraynor@redhat.com>
=C2=A0Ke Xu <ke1.xu@intel.com>
=C2=A0Ke Zhang <ke1x.zhang@intel.com>
+Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
=C2=A0Khoa To <khot@microsoft.com>
=C2=A0Kiran KN <kirankn@juniper.net>
=C2=A0Kiran Kumar K <kirankumark@marvell.com>
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_d= v.c
index d11e39431f..f3a76f9e93 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -16950,6 +16950,11 @@ flow_dv_query(struct rte_eth_dev *dev,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 error);
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 break;
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 case RTE_FLOW_ACTIO= N_TYPE_AGE:
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0if (flow->indirect_type =3D=3D MLX5_INDIRECT_ACTION_TYPE_CT) +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return rte_flow_error_set(error, ENOT= SUP,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0RTE_FLOW_ERROR_TYPE_ACTION,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0actions,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0"age not available");
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 ret =3D flow_dv_query_age(dev, flow, data, error);
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 break;
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 default:
--
2.47.2

---
=C2=A0 Diff of the applied patch vs upstream commit (please double-check if= non-empty:
---
--- -=C2=A0 =C2=A02025-06-30 13:21:21.850344929 +0100
+++ 0002-net-mlx5-fix-crash-on-age-query-with-indirect-conntr.patch=C2=A0 = =C2=A0 =C2=A02025-06-30 13:21:21.739057181 +0100
@@ -1 +1 @@
-From 3bb6e3bf05284f0668e2ac14ce4b90a2909dff99 Mon Sep 17 00:00:00 2001
+From ab74ac87bc7fe0554e3a2e0e6c94558647b9770d Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3bb6e3bf05284f0668e2ac14ce4b90a2909dff99 ]
+
@@ -35 +36,0 @@
-Cc: stable@dpdk.org
@@ -45 +46 @@
-index 8483d96ec5..6126f7e472 100644
+index 7e6ada5733..9a89b1a12e 100644
@@ -48 +49 @@
-@@ -812,6 +812,7 @@ Kevin Scott <kevin.c.scott@intel.com> +@@ -736,6 +736,7 @@ Kevin Scott <kevin.c.scott@intel.com> @@ -55 +56 @@
- Kiran Kumar K <kirankumark@marvell.com> <= kkokkilagadda@caviumnetworks.com> <kiran.kokki= lagadda@caviumnetworks.com>
+ Kiran Kumar K <kirankumark@marvell.com>
@@ -57 +58 @@
-index d555a9cdcb..7b9e5018b8 100644
+index d11e39431f..f3a76f9e93 100644
@@ -60 +61 @@
-@@ -18146,6 +18146,11 @@ flow_dv_query(struct rte_eth_dev *dev,
+@@ -16950,6 +16950,11 @@ flow_dv_query(struct rte_eth_dev *dev,
--0000000000000f73750638f3f912--