From: Kenneth Klette Jonassen <kenneth@bridgetech.tv>

The mlx5_fs_add_rule tracepoint has used the flow destination type in
a bitwise test since its introduction. However, that's not a valid way
to treat it anymore (if it ever was), and after commit d639af621600dc
("net/mlx5: fs, split software and IFC flow destination definitions"),
this mismatch caused nearly any destination type to be mistaken as a
flow counter, and thus stashing 32 bits of the mlx5_flow_destination
union into the counter_id field of the tracepoint.

Later commit 95f68e06b41b9e ("net/mlx5: fs, add counter object to flow
destination") exacerbates this issue by converting the counter union
member from an integer to a pointer. Now the tracepoint dereferences
whichever value is in the union, and in cases where that's not a valid
pointer, it can lead to a kernel oops.

Fix the check. Reported by GitHub user whi71800.

Cc: stable@vger.kernel.org
Fixes: 95f68e06b41b9e ("net/mlx5: fs, add counter object to flow destination")
Closes: https://github.com/knneth/mlnx-ofa_kernel/issues/1
Signed-off-by: Kenneth Klette Jonassen <kenneth@bridgetech.tv>
---
 drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
index d6e736c1fb24..b099fe71b781 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
@@ -289,7 +289,7 @@ TRACE_EVENT(mlx5_fs_add_rule,
 			   memcpy(__entry->destination,
 				  &rule->dest_attr,
 				  sizeof(__entry->destination));
-			   if (rule->dest_attr.type &
+			   if (rule->dest_attr.type ==
 			       MLX5_FLOW_DESTINATION_TYPE_COUNTER)
 				__entry->counter_id =
 					mlx5_fc_id(rule->dest_attr.counter);
-- 
2.43.0

On 3/28/2026 10:20 PM, kenneth@bridgetech.tv wrote:
> 
> The mlx5_fs_add_rule tracepoint has used the flow destination type in
> a bitwise test since its introduction. However, that's not a valid way
> to treat it anymore (if it ever was), and after commit d639af621600dc
> ("net/mlx5: fs, split software and IFC flow destination definitions"),
> this mismatch caused nearly any destination type to be mistaken as a
> flow counter, and thus stashing 32 bits of the mlx5_flow_destination
> union into the counter_id field of the tracepoint.
> 
> Later commit 95f68e06b41b9e ("net/mlx5: fs, add counter object to flow
> destination") exacerbates this issue by converting the counter union
> member from an integer to a pointer. Now the tracepoint dereferences
> whichever value is in the union, and in cases where that's not a valid
> pointer, it can lead to a kernel oops.
> 
> Fix the check. Reported by GitHub user whi71800.
> 
> Cc:stable@vger.kernel.org
> Fixes: 95f68e06b41b9e ("net/mlx5: fs, add counter object to flow destination")
> Closes:https://github.com/knneth/mlnx-ofa_kernel/issues/1
> Signed-off-by: Kenneth Klette Jonassen<kenneth@bridgetech.tv>

Reviewed-by: Moshe Shemesh <moshe@nvidia.com>

Thanks.