net/mlx5: fix destroying empty matchers list

PATCH In review Adham Masarwah 4 participants 4 messages Feb 23, 2022 – Mar 2, 2022 2 messages not in the archive Network drivers

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Adham Masarwah

author

2022-02-23 10:25 UTC #1 lore raw

PATCH 1/1 net/mlx5: fix destroying empty matchers list

The table remove callback function is trying to destroy the matchers list associated with table entries without checking if the list is valid, which causes nullptr dereference. Fixed by validating the matchers list before destroying it.

Issue can be reproduced with testpmd on Windows, when you run:
port close all

Fixes 1872635570be ("net/mlx5: make matcher list thread safe")

Cc [email protected]

Signed-off-by Adham Masarwah <[email protected]>

Acked-by Viacheslav Ovsiienko <[email protected]>

---
 drivers/net/mlx5/mlx5_flow_dv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/net/mlx5/mlx5_flow_dv.c +2 -1

index ef9c66eddf..baef252a7a 100644
@@ -10503,7 +10503,8 @@ flow_dv_tbl_remove_cb(void *tool_ctx, struct mlx5_list_entry *entry)
 			tbl_data->tunnel->tunnel_id : 0,
 			tbl_data->group_id);
 	}
-	mlx5_list_destroy(tbl_data->matchers);
+	if (tbl_data->matchers)
+		mlx5_list_destroy(tbl_data->matchers);
 	mlx5_ipool_free(sh->ipool[MLX5_IPOOL_JUMP], tbl_data->idx);
 }

Signature · 1 line

2.16.1.windows.4

Tal Shnaiderman

Acked-by on v1 1/1

2022-02-23 10:39 UTC #2 lore raw

Quoted 34 lines

Subject: [PATCH] net/mlx5: fix destroying empty matchers list
The table remove callback function is trying to destroy the matchers list associated with table entries without checking if the list is valid, which causes nullptr dereference.
Fixed by validating the matchers list before destroying it.
Issue can be reproduced with testpmd on Windows, when you run:
port close all
Fixes 1872635570be ("net/mlx5: make matcher list thread safe")
Cc [email protected]
Signed-off-by Adham Masarwah <[email protected]>
Acked-by Viacheslav Ovsiienko <[email protected]>
---
 drivers/net/mlx5/mlx5_flow_dv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
(quoted diff) +0 -0
b/drivers/net/mlx5/mlx5_flow_dv.c index ef9c66eddf..baef252a7a 100644
drivers/net/mlx5/mlx5_flow_dv.c +2 -2
@@ -10503,7 +10503,8 @@ flow_dv_tbl_remove_cb(void *tool_ctx, struct
 mlx5_list_entry *entry)
 			tbl_data->tunnel->tunnel_id : 0,
 			tbl_data->group_id);
 	}
-	mlx5_list_destroy(tbl_data->matchers);
+	if (tbl_data->matchers)
+		mlx5_list_destroy(tbl_data->matchers);
 	mlx5_ipool_free(sh->ipool[MLX5_IPOOL_JUMP], tbl_data->idx);  }
 
--

Quoted 1 line

2.16.1.windows.4

Acked-by Tal Shnaiderman <[email protected]>

A message that is not in the archive (sent off-list or not yet received): CY4PR12MB1270E204766E1F5F930D45E9C9009@CY4PR12MB1270.namprd12.prod.outlook.com

Idan Hackmon

Tested-by

2022-02-28 16:01 UTC #4 lore raw

Quoted 41 lines

-----Original Message-----
From: Adham Masarwah <[email protected]>
Sent: Sunday, February 27, 2022 2:33 PM
To: Idan Hackmon <[email protected]>
Subject: RE: [PATCH] net/mlx5: fix destroying empty matchers list
Quoted 33 lines
Subject: [PATCH] net/mlx5: fix destroying empty matchers list
The table remove callback function is trying to destroy the matchers list associated with table entries without checking if the list is valid, which causes nullptr dereference.
Fixed by validating the matchers list before destroying it.
Issue can be reproduced with testpmd on Windows, when you run:
port close all
Fixes 1872635570be ("net/mlx5: make matcher list thread safe")
Cc [email protected]
Signed-off-by Adham Masarwah <[email protected]>
Acked-by Viacheslav Ovsiienko <[email protected]>
---
 drivers/net/mlx5/mlx5_flow_dv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
(quoted diff) +0 -0
b/drivers/net/mlx5/mlx5_flow_dv.c index ef9c66eddf..baef252a7a 100644
drivers/net/mlx5/mlx5_flow_dv.c +2 -1
@@ -10503,7 +10503,8 @@ flow_dv_tbl_remove_cb(void *tool_ctx, struct
 mlx5_list_entry *entry)
 			tbl_data->tunnel->tunnel_id : 0,
 			tbl_data->group_id);
 	}
-	mlx5_list_destroy(tbl_data->matchers);
+	if (tbl_data->matchers)
+		mlx5_list_destroy(tbl_data->matchers);
 	mlx5_ipool_free(sh->ipool[MLX5_IPOOL_JUMP], tbl_data->idx);  }
 

Quoted 4 lines

Quoted 2 lines
--
2.16.1.windows.4
Acked-by Tal Shnaiderman <[email protected]>

Tested-by Idan Hackmon <[email protected]>

Raslan Darawsheh

2022-03-02 10:20 UTC #5 lore raw

In reply to Adham Masarwah

Hi,

Quoted 15 lines

-----Original Message-----
From: Adham Masarwah <[email protected]>
Sent: Wednesday, February 23, 2022 11:32 AM
To: [email protected]
Cc: NBU-Contact-Thomas Monjalon (EXTERNAL) <[email protected]>; Matan Azrad <[email protected]>; Slava Ovsiienko <[email protected]>; Tal Shnaiderman <[email protected]>; Tamer Hleihel <[email protected]>; [email protected]; [email protected]
Subject: [PATCH] net/mlx5: fix destroying empty matchers list
The table remove callback function is trying to destroy the matchers list associated with table entries without checking if the list is valid, which causes nullptr dereference. Fixed by validating the matchers list before destroying it.

Quoted 8 lines

Issue can be reproduced with testpmd on Windows, when you run:
port close all
Fixes 1872635570be ("net/mlx5: make matcher list thread safe")
Cc [email protected]
Signed-off-by Adham Masarwah <[email protected]>
Acked-by Viacheslav Ovsiienko <[email protected]>

Patch applied to next-net-mlx,

Kindest regards,
Raslan Darawsheh