1. Patchew
  2. linux
  3. [PATCH v5 0/2] net/mlx5: Fix NULL dereference and memory leak in ttc_table creation
  4. View patch

[PATCH v5 1/2] net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()

Henry Martin posted 2 patches 8 months, 1 week ago
There is a newer version of this series
[PATCH v5 1/2] net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
Posted by Henry Martin 8 months, 1 week ago 
Add NULL check for mlx5_get_flow_namespace() returns in
mlx5_create_inner_ttc_table() and mlx5_create_ttc_table() to prevent
NULL pointer dereference.

Fixes: 137f3d50ad2a ("net/mlx5: Support matching on l4_type for ttc_table")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
index eb3bd9c7f66e..e48afd620d7e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
@@ -655,6 +655,11 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
 	}
 
 	ns = mlx5_get_flow_namespace(dev, params->ns_type);
+	if (!ns) {
+		kvfree(ttc);
+		return ERR_PTR(-EOPNOTSUPP);
+	}
+
 	groups = use_l4_type ? &inner_ttc_groups[TTC_GROUPS_USE_L4_TYPE] :
 			       &inner_ttc_groups[TTC_GROUPS_DEFAULT];
 
@@ -728,6 +733,11 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
 	}
 
 	ns = mlx5_get_flow_namespace(dev, params->ns_type);
+	if (!ns) {
+		kvfree(ttc);
+		return ERR_PTR(-EOPNOTSUPP);
+	}
+
 	groups = use_l4_type ? &ttc_groups[TTC_GROUPS_USE_L4_TYPE] :
 			       &ttc_groups[TTC_GROUPS_DEFAULT];
 
-- 
2.34.1
Re: [PATCH v5 1/2] net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
Posted by Mark Bloch 8 months, 1 week ago 

On 15/04/2025 15:41, Henry Martin wrote:
> Add NULL check for mlx5_get_flow_namespace() returns in
> mlx5_create_inner_ttc_table() and mlx5_create_ttc_table() to prevent
> NULL pointer dereference.
> 
> Fixes: 137f3d50ad2a ("net/mlx5: Support matching on l4_type for ttc_table")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> index eb3bd9c7f66e..e48afd620d7e 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> @@ -655,6 +655,11 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
>  	}
>  
>  	ns = mlx5_get_flow_namespace(dev, params->ns_type);
> +	if (!ns) {
> +		kvfree(ttc);
> +		return ERR_PTR(-EOPNOTSUPP);
> +	}
> +
>  	groups = use_l4_type ? &inner_ttc_groups[TTC_GROUPS_USE_L4_TYPE] :
>  			       &inner_ttc_groups[TTC_GROUPS_DEFAULT];
>  
> @@ -728,6 +733,11 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
>  	}
>  
>  	ns = mlx5_get_flow_namespace(dev, params->ns_type);
> +	if (!ns) {
> +		kvfree(ttc);
> +		return ERR_PTR(-EOPNOTSUPP);
> +	}
> +
>  	groups = use_l4_type ? &ttc_groups[TTC_GROUPS_USE_L4_TYPE] :
>  			       &ttc_groups[TTC_GROUPS_DEFAULT];
>  

Reviewed-by: Mark Bloch <mbloch@nvidia.com>

Mark
Re: [PATCH v5 1/2] net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
Posted by Tariq Toukan 8 months, 1 week ago 

On 15/04/2025 16:45, Mark Bloch wrote:
> 
> 
> On 15/04/2025 15:41, Henry Martin wrote:
>> Add NULL check for mlx5_get_flow_namespace() returns in
>> mlx5_create_inner_ttc_table() and mlx5_create_ttc_table() to prevent
>> NULL pointer dereference.
>>
>> Fixes: 137f3d50ad2a ("net/mlx5: Support matching on l4_type for ttc_table")
>> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
>> ---
>>   drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 10 ++++++++++
>>   1 file changed, 10 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
>> index eb3bd9c7f66e..e48afd620d7e 100644
>> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
>> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
>> @@ -655,6 +655,11 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
>>   	}
>>   
>>   	ns = mlx5_get_flow_namespace(dev, params->ns_type);
>> +	if (!ns) {
>> +		kvfree(ttc);
>> +		return ERR_PTR(-EOPNOTSUPP);
>> +	}
>> +
>>   	groups = use_l4_type ? &inner_ttc_groups[TTC_GROUPS_USE_L4_TYPE] :
>>   			       &inner_ttc_groups[TTC_GROUPS_DEFAULT];
>>   
>> @@ -728,6 +733,11 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
>>   	}
>>   
>>   	ns = mlx5_get_flow_namespace(dev, params->ns_type);
>> +	if (!ns) {
>> +		kvfree(ttc);
>> +		return ERR_PTR(-EOPNOTSUPP);
>> +	}
>> +
>>   	groups = use_l4_type ? &ttc_groups[TTC_GROUPS_USE_L4_TYPE] :
>>   			       &ttc_groups[TTC_GROUPS_DEFAULT];
>>   
> 
> Reviewed-by: Mark Bloch <mbloch@nvidia.com>
> 
> Mark
> 

netdev maintainers,

Note that Mark is covering me while I'm on vacation (for the coming ~10 
days). Please accordingly honor his submissions and replies for mlx5 
content.

In case this mail notification is not sufficient, please let us know 
what extra action is required.

Happy Holidays,
Tariq

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.