From nobody Sun Feb 8 11:26:32 2026 Received: from out-172.mta1.migadu.com (out-172.mta1.migadu.com [95.215.58.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 166EE32E138; Mon, 12 Jan 2026 08:04:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768205059; cv=none; b=UjQg3U2CYZ7IQH/+3RY6L529j3XdpeCGr+0gJMHIf45/R3nJA/wvT4eKHuSXbcKa5tZaMb2trwUDFHmN6qQb8wN4WZclfZWJDjpmGJrHmBynhNm3Krf3Q3IW95uKvHMAZGTGW8Nfr1hEdXyqRp9lZLiVAIf17P76M6xMrlXn/t8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768205059; c=relaxed/simple; bh=N89CHE+jyXjgzNAuRTZUQT2yOxWFHhz2J4jXh2RqipE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LnS0ZLVg+qbS1Vh25KyV73FbDZuDFnin304TgSMnMgB5FNW64ueyedI6Y/hcf553CV3FDGTjBWHoB8PRG8kgGPO/AxlSRph+QBazxFjA2PqzXxHi3En5QUvb0gDPyfaM9gEuLP9nscUXb7BtdWSicOI4GaOfNm4b281YFaGmRww= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=fhTLfgsl; arc=none smtp.client-ip=95.215.58.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="fhTLfgsl" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1768205051; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=p4Z4ytyxGeEbNSpkRlt95EmE6o89ZwisT6/HLnk71e4=; b=fhTLfgslzcQo2Qbxa+67R+P/b/RAEaHadpj8X9gtQ8BCuasRHCgdYzi7sIOYxTD1F0LrQG DYBul1b9uxDxT07d/3vPT4vGP56DFo+iXAKWZVjPgcEM4Rg3fAESYFsj8KguJLXVi5TzNb Se/US4LLPCY/GJPzhL+nYdSkUIu8vf4= From: Leon Hwang To: netdev@vger.kernel.org Cc: Saeed Mahameed , Tariq Toukan , Mark Bloch , Leon Romanovsky , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Oz Shlomo , Paul Blakey , Khalid Manaa , Achiad Shochat , Jiayuan Chen , linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, Leon Hwang , Leon Huang Fu Subject: [PATCH net-next] net/mlx5e: Mask wqe_id when handling rx cqe Date: Mon, 12 Jan 2026 16:03:23 +0800 Message-ID: <20260112080323.65456-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" The wqe_id from CQE contains wrap counter bits in addition to the WQE index. Mask it with sz_m1 to prevent out-of-bounds access to the rq->mpwqe.info[] array when wrap counter causes wqe_id to exceed RQ size. Without this fix, the driver crashes with NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:mlx5e_skb_from_cqe_mpwrq_linear+0xb3/0x280 [mlx5_core] Call Trace: mlx5e_handle_rx_cqe_mpwrq+0xe3/0x290 [mlx5_core] mlx5e_poll_rx_cq+0x97/0x820 [mlx5_core] mlx5e_napi_poll+0x110/0x820 [mlx5_core] Fixes: dfd9e7500cd4 ("net/mlx5e: Rx, Split rep rx mpwqe handler from nic") Fixes: f97d5c2a453e ("net/mlx5e: Add handle SHAMPO cqe support") Fixes: 461017cb006a ("net/mlx5e: Support RX multi-packet WQE (Striding RQ)") Signed-off-by: Leon Huang Fu Signed-off-by: Leon Hwang --- drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 5 +++++ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 6 +++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/ne= t/ethernet/mellanox/mlx5/core/en/txrx.h index 7e191e1569e8..df8e671d5115 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h @@ -583,4 +583,9 @@ static inline struct mlx5e_mpw_info *mlx5e_get_mpw_info= (struct mlx5e_rq *rq, int =20 return (struct mlx5e_mpw_info *)((char *)rq->mpwqe.info + array_size(i, i= sz)); } + +static inline u16 mlx5e_rq_cqe_wqe_id(struct mlx5e_rq *rq, struct mlx5_cqe= 64 *cqe) +{ + return be16_to_cpu(cqe->wqe_id) & rq->mpwqe.wq.fbc.sz_m1; +} #endif diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/= ethernet/mellanox/mlx5/core/en_rx.c index 1f6930c77437..25c04684271c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -1957,7 +1957,7 @@ static void mlx5e_handle_rx_cqe_rep(struct mlx5e_rq *= rq, struct mlx5_cqe64 *cqe) static void mlx5e_handle_rx_cqe_mpwrq_rep(struct mlx5e_rq *rq, struct mlx5= _cqe64 *cqe) { u16 cstrides =3D mpwrq_get_cqe_consumed_strides(cqe); - u16 wqe_id =3D be16_to_cpu(cqe->wqe_id); + u16 wqe_id =3D mlx5e_rq_cqe_wqe_id(rq, cqe); struct mlx5e_mpw_info *wi =3D mlx5e_get_mpw_info(rq, wqe_id); u16 stride_ix =3D mpwrq_get_cqe_stride_index(cqe); u32 wqe_offset =3D stride_ix << rq->mpwqe.log_stride_sz; @@ -2373,7 +2373,7 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct m= lx5e_rq *rq, struct mlx5_cq u16 cstrides =3D mpwrq_get_cqe_consumed_strides(cqe); u32 data_offset =3D wqe_offset & (PAGE_SIZE - 1); u32 cqe_bcnt =3D mpwrq_get_cqe_byte_cnt(cqe); - u16 wqe_id =3D be16_to_cpu(cqe->wqe_id); + u16 wqe_id =3D mlx5e_rq_cqe_wqe_id(rq, cqe); u32 page_idx =3D wqe_offset >> PAGE_SHIFT; u16 head_size =3D cqe->shampo.header_size; struct sk_buff **skb =3D &rq->hw_gro_data->skb; @@ -2478,7 +2478,7 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct m= lx5e_rq *rq, struct mlx5_cq static void mlx5e_handle_rx_cqe_mpwrq(struct mlx5e_rq *rq, struct mlx5_cqe= 64 *cqe) { u16 cstrides =3D mpwrq_get_cqe_consumed_strides(cqe); - u16 wqe_id =3D be16_to_cpu(cqe->wqe_id); + u16 wqe_id =3D mlx5e_rq_cqe_wqe_id(rq, cqe); struct mlx5e_mpw_info *wi =3D mlx5e_get_mpw_info(rq, wqe_id); u16 stride_ix =3D mpwrq_get_cqe_stride_index(cqe); u32 wqe_offset =3D stride_ix << rq->mpwqe.log_stride_sz; --=20 2.52.0