From: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
To: dev@dpdk.org
Cc: rasland@nvidia.com, Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>,
stable@dpdk.org
Subject: [PATCH v2] net/mlx5: fix segfault on indirect action age query with conntrack
Date: Thu, 26 Jun 2025 09:07:02 -0400 [thread overview]
Message-ID: <20250626130702.3921887-1-14pwcse1224@uetpeshawar.edu.pk> (raw)
v2:
- Added missing check for AGE + CT conflict in flow_dv_query().
- Removed unnecessary null check from flow_aso_age_get_by_idx().
- Added Fixes tag for LTS tracking.
- Ensured .mailmap and Signed-off-by addresses match.
This patch fixes a segmentation fault that occurs when querying the
AGE action of a flow rule that uses indirect connection tracking (CT).
Background:
AGE and CT indices share a union in the mlx5 flow struct. When using CT
without age, the age index is invalid. Querying AGE in this case leads
to a crash due to reading an invalid pointer.
Fix:
Add a check in `flow_dv_query()` to prevent AGE queries on indirect CT
actions. This is the correct fix rather than null-checking the pool.
Steps to reproduce:
1. Create an indirect CT action:
flow indirect_action 0 create ingress action conntrack / end
2. Create a root rule with jump:
flow create 0 ingress pattern eth / ipv4 / tcp / end actions jump group 3 / end
3. Create a group 3 rule using the indirect action:
flow create 0 group 3 ingress pattern eth / ipv4 / tcp / end actions indirect 0 / jump group 5 / end
4. Create a group 5 rule matching CT state:
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 1 / end actions queue index 5 / end
5. Querying the first rule causes segfault:
flow query 0 1 age
Fixes: 2d084f69aa26 ("net/mlx5: add translation of connection tracking action")
Cc: stable@dpdk.org
Signed-off-by: Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
---
.mailmap | 1 +
drivers/net/mlx5/mlx5_flow_dv.c | 5 +++++
2 files changed, 6 insertions(+)
diff --git a/.mailmap b/.mailmap
index 8483d96ec5..6126f7e472 100644
--- a/.mailmap
+++ b/.mailmap
@@ -812,6 +812,7 @@ Kevin Scott <kevin.c.scott@intel.com>
Kevin Traynor <ktraynor@redhat.com>
Ke Xu <ke1.xu@intel.com>
Ke Zhang <ke1x.zhang@intel.com>
+Khadem Ullah <14pwcse1224@uetpeshawar.edu.pk>
Khoa To <khot@microsoft.com>
Kiran KN <kirankn@juniper.net>
Kiran Kumar K <kirankumark@marvell.com> <kkokkilagadda@caviumnetworks.com> <kiran.kokkilagadda@caviumnetworks.com>
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index c217634d9b..7ce093e075 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -18134,6 +18134,11 @@ flow_dv_query(struct rte_eth_dev *dev,
error);
break;
case RTE_FLOW_ACTION_TYPE_AGE:
+ if (flow->indirect_type == MLX5_INDIRECT_ACTION_TYPE_CT)
+ return rte_flow_error_set(error, ENOTSUP,
+ RTE_FLOW_ERROR_TYPE_ACTION,
+ actions,
+ "age not available");
ret = flow_dv_query_age(dev, flow, data, error);
break;
default:
--
2.43.0
next reply other threads:[~2025-06-26 13:07 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-26 13:07 Khadem Ullah [this message]
2025-06-26 13:32 ` Dariusz Sosnowski
2025-06-26 14:29 ` Khadem Ullah
-- strict thread matches above, loose matches on Subject: below --
2025-06-24 5:10 [PATCH] " Khadem Ullah
2025-06-26 13:22 ` [PATCH v2] " Khadem Ullah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250626130702.3921887-1-14pwcse1224@uetpeshawar.edu.pk \
--to=14pwcse1224@uetpeshawar.edu.pk \
--cc=dev@dpdk.org \
--cc=rasland@nvidia.com \
--cc=stable@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).