1. Patchew
  2. linux
  3. View series

[PATCH net v1] net/mlx5: Fix HWS action unwind NULL dereference

Prathamesh Deshpande posted 1 patch 1 month, 1 week ago 
.../mellanox/mlx5/core/steering/hws/fs_hws.c     | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
[PATCH net v1] net/mlx5: Fix HWS action unwind NULL dereference
Posted by Prathamesh Deshpande 1 month, 1 week ago 
mlx5_fs_fte_get_hws_actions() stores some destination actions in
fs_actions[] before checking whether action creation succeeded.

If creating a table-number or range destination action fails, or if
fetching a sampler destination action fails, dest_action is NULL but
num_fs_actions has already been incremented. The shared error path then
calls mlx5_fs_destroy_fs_action(), which dereferences fs_action->action
to get the HWS action type, causing a NULL pointer dereference while
unwinding the original failure.

Track whether the current destination action needs fs_actions[] cleanup,
but append it only after dest_action has been validated.

Fixes: 2ec6786ad0a6b ("net/mlx5: fs, add HWS fte API functions")
Fixes: 32e658c84b6d ("net/mlx5: fs, add support for dest flow sampler HWS action")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
---
 .../mellanox/mlx5/core/steering/hws/fs_hws.c     | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
index aca77853abb8..fb12513dd83d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
@@ -950,6 +950,7 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
 			struct mlx5_flow_destination *attr = &dst->dest_attr;
 			bool type_uplink =
 				attr->type == MLX5_FLOW_DESTINATION_TYPE_UPLINK;
+			bool record_fs_action = false;
 
 			if (num_fs_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
 			    num_dest_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
@@ -973,11 +974,11 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
 					break;
 				dest_action = mlx5_fs_create_dest_action_table_num(fs_ctx,
 										   dst);
-				fs_actions[num_fs_actions++].action = dest_action;
+				record_fs_action = true;
 				break;
 			case MLX5_FLOW_DESTINATION_TYPE_RANGE:
 				dest_action = mlx5_fs_create_dest_action_range(ctx, dst);
-				fs_actions[num_fs_actions++].action = dest_action;
+				record_fs_action = true;
 				break;
 			case MLX5_FLOW_DESTINATION_TYPE_UPLINK:
 			case MLX5_FLOW_DESTINATION_TYPE_VPORT:
@@ -988,9 +989,7 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
 				dest_action =
 					mlx5_fs_get_dest_action_sampler(fs_ctx,
 									dst);
-				fs_actions[num_fs_actions].action = dest_action;
-				fs_actions[num_fs_actions++].sampler_id =
-							dst->dest_attr.sampler_id;
+				record_fs_action = true;
 				break;
 			default:
 				err = -EOPNOTSUPP;
@@ -1000,6 +999,13 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
 				err = -ENOMEM;
 				goto free_actions;
 			}
+			if (record_fs_action) {
+				fs_actions[num_fs_actions].action = dest_action;
+				if (attr->type == MLX5_FLOW_DESTINATION_TYPE_FLOW_SAMPLER)
+					fs_actions[num_fs_actions].sampler_id =
+								dst->dest_attr.sampler_id;
+				num_fs_actions++;
+			}
 			dest_actions[num_dest_actions++].dest = dest_action;
 		}
 	}
-- 
2.43.0
Re: [PATCH net v1] net/mlx5: Fix HWS action unwind NULL dereference
Posted by Simon Horman 1 month ago 
On Mon, May 04, 2026 at 11:06:46PM +0100, Prathamesh Deshpande wrote:
> mlx5_fs_fte_get_hws_actions() stores some destination actions in
> fs_actions[] before checking whether action creation succeeded.
> 
> If creating a table-number or range destination action fails, or if
> fetching a sampler destination action fails, dest_action is NULL but
> num_fs_actions has already been incremented. The shared error path then
> calls mlx5_fs_destroy_fs_action(), which dereferences fs_action->action
> to get the HWS action type, causing a NULL pointer dereference while
> unwinding the original failure.
> 
> Track whether the current destination action needs fs_actions[] cleanup,
> but append it only after dest_action has been validated.
> 
> Fixes: 2ec6786ad0a6b ("net/mlx5: fs, add HWS fte API functions")
> Fixes: 32e658c84b6d ("net/mlx5: fs, add support for dest flow sampler HWS action")
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>
Re: [PATCH net v1] net/mlx5: Fix HWS action unwind NULL dereference
Posted by Moshe Shemesh 1 month, 1 week ago 

On 5/5/2026 1:06 AM, Prathamesh Deshpande wrote:
> mlx5_fs_fte_get_hws_actions() stores some destination actions in
> fs_actions[] before checking whether action creation succeeded.
> 
> If creating a table-number or range destination action fails, or if
> fetching a sampler destination action fails, dest_action is NULL but
> num_fs_actions has already been incremented. The shared error path then
> calls mlx5_fs_destroy_fs_action(), which dereferences fs_action->action
> to get the HWS action type, causing a NULL pointer dereference while
> unwinding the original failure.
> 
> Track whether the current destination action needs fs_actions[] cleanup,
> but append it only after dest_action has been validated.
> 
> Fixes: 2ec6786ad0a6b ("net/mlx5: fs, add HWS fte API functions")
> Fixes: 32e658c84b6d ("net/mlx5: fs, add support for dest flow sampler HWS action")
> Signed-off-by: Prathamesh Deshpande<prathameshdeshpande7@gmail.com>

Acked-by: Moshe Shemesh <moshe@nvidia.com>

> ---
>   .../mellanox/mlx5/core/steering/hws/fs_hws.c     | 16 +++++++++++-----
>   1 file changed, 11 insertions(+), 5 deletions(-)

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.