[DPDK/ethdev Bug 1661] mlx5: rte_flow_create can cause a seg fault

[DPDK/ethdev Bug 1661] mlx5: rte_flow_create can cause a seg fault

[bugzilla]

[-- Attachment #1: Type: text/plain, Size: 6548 bytes --]

https://bugs.dpdk.org/show_bug.cgi?id=1661

            Bug ID: 1661
           Summary: mlx5: rte_flow_create can cause a seg fault
           Product: DPDK
           Version: 24.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: ethdev
          Assignee: dev@dpdk.org
          Reporter: ktraynor@redhat.com
  Target Milestone: ---

Depending on NIC configuration, a seg fault can occur when calling
rte_flow_create() because mlx5_flow_null_drv_ops does not have a .list_create
implementation.

Details:

Driver type gets selected from flow_get_drv_type() and can return
MLX5_FLOW_TYPE_MAX


 4180│ flow_get_drv_type(struct rte_eth_dev *dev, const struct rte_flow_attr
*attr)
 4181│ {
 4182│         struct mlx5_priv *priv = dev->data->dev_private;
 4183│         /* The OS can determine first a specific flow type (DV, VERBS)
*/
 4184│         enum mlx5_flow_drv_type type = mlx5_flow_os_get_type();
 4185│
 4186│         if (type != MLX5_FLOW_TYPE_MAX)
 4187│                 return type;
 4188│         /*
 4189│          * Currently when dv_flow_en == 2, only HW steering engine is
 4190│          * supported. New engines can also be chosen here if ready.
 4191│          */
 4192│         if (priv->sh->config.dv_flow_en == 2)
 4193│                 return MLX5_FLOW_TYPE_HW;
 4194│         if (!attr)
 4195│                 return MLX5_FLOW_TYPE_MIN;
 4196│         /* If no OS specific type - continue with DV/VERBS selection */
 4197│         if (attr->transfer && priv->sh->config.dv_esw_en)
 4198│                 type = MLX5_FLOW_TYPE_DV;
 4199│         if (!attr->transfer)
 4200│                 type = priv->sh->config.dv_flow_en ? MLX5_FLOW_TYPE_DV :
 4201│                                                     
MLX5_FLOW_TYPE_VERBS;
 4202├>        return type;
 4203│ }

(gdb) p type
$1 = MLX5_FLOW_TYPE_MAX
(gdb) p attr->transfer
$2 = 1
(gdb) p priv->sh->config
$5 = {tx_pp = 0, tx_skew = 0, reclaim_mode = 0, dv_esw_en = 0, dv_flow_en = 1,
dv_xmeta_en = 0, dv_miss_info = 0, l3_vxlan_en = 0, vf_nl_en = 1, lacp_by_user
=
0, decap_en = 1, hw_fcs_strip = 1, allow_duplicate_pattern = 1, lro_allowed =
1, cnt_svc = {service_core = 0, cycle_time = 500}, fdb_def_rule = 1,
repr_matching
 = 1}

In this case flow_get_drv_ops() selects mlx5_flow_null_drv_ops, which does not
have a .list_create implementation.


 8032│ uintptr_t
 8033│ mlx5_flow_list_create(struct rte_eth_dev *dev, enum mlx5_flow_type type,
 8034│                       const struct rte_flow_attr *attr,
 8035│                       const struct rte_flow_item items[],
 8036│                       const struct rte_flow_action actions[],
 8037│                       bool external, struct rte_flow_error *error)
 8038│ {
 8039│         const struct mlx5_flow_driver_ops *fops;
 8040│         enum mlx5_flow_drv_type drv_type = flow_get_drv_type(dev, attr);
 8041│
 8042│         fops = flow_get_drv_ops(drv_type);
 8043├>        return fops->list_create(dev, type, attr, items, actions,
external,
 8044│                 error);
 8045│ }

(gdb) p drv_type
$1 = MLX5_FLOW_TYPE_MAX
(gdb) p fops
$2 = (const struct mlx5_flow_driver_ops *) 0x45b34e0 <mlx5_flow_null_drv_ops>
(gdb) p fops->list_create
$3 = (mlx5_flow_list_create_t) 0x0

As there is no list_create, it causes a seg fault

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000000000158a6b1 in mlx5_flow_list_create (dev=0x4e87500
<rte_eth_devices+33152>, type=MLX5_FLOW_TYPE_GEN, attr=0x7f0095666c98,
items=0x7f008000e1a0, actions=0x7f008000dd10, external=true,
error=0x7f0095666c30) at ../drivers/net/mlx
5/mlx5_flow.c:8043
#2  0x000000000158a535 in mlx5_flow_create (dev=0x4e87500
<rte_eth_devices+33152>, attr=0x7f0095666c98, items=0x7f008000e1a0,
actions=0x7f008000dd10, error=0x7f0095666c30) at
../drivers/net/mlx5/mlx5_flow.c:8019
#3  0x00000000037a51af in rte_flow_create (port_id=2, attr=0x7f0095666c98,
pattern=0x7f008000e1a0, actions=0x7f008000dd10, error=0x7f0095666c30) at
../lib/ethdev/rte_flow.c:420
#4  0x0000000003a86d6f in netdev_dpdk_rte_flow_create (netdev=0x17d15a5c0,
attr=0x7f0095666c98, items=0x7f008000e1a0, actions=0x7f008000dd10,
error=0x7f0095666c30) at lib/netdev-dpdk.c:6539
#5  0x0000000003a8b798 in netdev_offload_dpdk_flow_create (netdev=0x17d15a5c0,
attr=0x7f0095666c98, flow_patterns=0x7f0095666d00, flow_actions=0x7f0095666c50,
error=0x7f0095666c30) at lib/netdev-offload-dpdk.c:927
#6  0x0000000003a8f3af in netdev_offload_dpdk_actions (netdev=0x17d15a5c0,
patterns=0x7f0095666d00, nl_actions=0x7f0088005be0, actions_len=8) at
lib/netdev-offload-dpdk.c:2292
#7  0x0000000003a8f563 in netdev_offload_dpdk_add_flow (netdev=0x17d15a5c0,
match=0x7f0088009010, nl_actions=0x7f0088005be0, actions_len=8,
ufid=0x7f0088008888, info=0x7f0095666ed0) at lib/netdev-offload-dpdk.c:2322
#8  0x0000000003a8fb27 in netdev_offload_dpdk_flow_put (netdev=0x17d15a5c0,
match=0x7f0088009010, actions=0x7f0088005be0, actions_len=8,
ufid=0x7f0088008888, info=0x7f0095666ed0, stats=0x0) at
lib/netdev-offload-dpdk.c:2456
#9  0x000000000394800b in netdev_flow_put (netdev=0x17d15a5c0,
match=0x7f0088009010, actions=0x7f0088005be0, act_len=8, ufid=0x7f0088008888,
info=0x7f0095666ed0, stats=0x0) at lib/netdev-offload.c:318
#10 0x00000000038f19a5 in dp_netdev_flow_offload_put (item=0x7f0088008fe0) at
lib/dpif-netdev.c:2853
#11 0x00000000038f1a83 in dp_offload_flow (item=0x7f0088008fe0) at
lib/dpif-netdev.c:2889
#12 0x00000000038f1d27 in dp_netdev_flow_offload_main (arg=0x7f0090001700) at
lib/dpif-netdev.c:2960
#13 0x00000000039d618f in ovsthread_wrapper (aux_=0x7f0090002dd0) at
lib/ovs-thread.c:429
#14 0x00007f00c60631ca in start_thread () from /lib64/libpthread.so.0
#15 0x00007f00c3337e73 in clone () from /lib64/libc.so.6

Simple solution to avoid seg fault is to create a null ops implementation for
list_create.

I'm not sure right now if there is an additional bug with the device flow
driver ops selection as it requires more knowledge about NIC config and device
flow drivers selection.

For now, I will send a patch to fix the seg fault. Would be helpful if someone
from Nvidia could review the device flow driver selection for correctness and
user docs on flow modes.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #2: Type: text/html, Size: 8496 bytes --]