From: Changyul Lee <lcy8047@gmail.com>
To: Saeed Mahameed <saeedm@nvidia.com>,
Leon Romanovsky <leon@kernel.org>,
Tariq Toukan <tariqt@nvidia.com>, Mark Bloch <mbloch@nvidia.com>,
Andrew Lunn <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>
Cc: Sabrina Dubroca <sd@queasysnail.net>,
Simon Horman <horms@kernel.org>,
Joas Antonio dos Santos <joasantonio108@gmail.com>,
Patrisious Haddad <phaddad@nvidia.com>,
netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
linux-kernel@vger.kernel.org, Changyul Lee <lcy8047@gmail.com>
Subject: [PATCH net] net/mlx5: macsec: Don't remove fs_id when adding a rule fails
Date: Wed, 4 Nov 2026 19:34:19 -0500 [thread overview]
Message-ID: <20261105003419.4016283-1-lcy8047@gmail.com> (raw)
macsec_fs_tx_add_rule() and macsec_fs_rx_add_rule() clean up a failed
rule with macsec_fs_{tx,rx}_del_rule(), which also calls
macsec_fs_id_del(). The fs_id is never in the xarray at that point:
macsec_fs_id_add() is the last step of adding a rule and removes its
own entry when it fails.
macsec_fs_id_del() then dereferences NULL, through macsec_device for
the first SA of a MACsec netdev and through fs_id_found otherwise. On
RX, the SAs of one SC share an fs_id, so a failure while adding another
SA drops the reference that an existing SA holds.
Split the rule teardown from the fs_id removal and do only the teardown
on the error paths.
Fixes: d4ece08f4b1d ("net/mlx5: Maintain fs_id xarray per MACsec device inside macsec steering")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
Found with a static analysis tool we are developing.
Compile-tested only (x86_64, W=1, CONFIG_MLX5_MACSEC=y). I do not have
MACsec-capable ConnectX hardware and QEMU does not emulate it, so the
failure was not reproduced.
.../mellanox/mlx5/core/lib/macsec_fs.c | 38 ++++++++++++-------
1 file changed, 24 insertions(+), 14 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
index 7d785c937d43..4892175ca577 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
@@ -764,13 +764,9 @@ static int macsec_fs_id_add(struct list_head *macsec_devices_list, u32 fs_id,
return err;
}
-static void macsec_fs_tx_del_rule(struct mlx5_macsec_fs *macsec_fs,
- struct mlx5_macsec_tx_rule *tx_rule,
- void *macdev)
+static void macsec_fs_tx_free_rule(struct mlx5_macsec_fs *macsec_fs,
+ struct mlx5_macsec_tx_rule *tx_rule)
{
- macsec_fs_id_del(&macsec_fs->macsec_devices_list, tx_rule->fs_id, macdev,
- &macsec_fs->sci_hash, true);
-
if (tx_rule->rule) {
mlx5_del_flow_rules(tx_rule->rule);
tx_rule->rule = NULL;
@@ -791,6 +787,15 @@ static void macsec_fs_tx_del_rule(struct mlx5_macsec_fs *macsec_fs,
macsec_fs_tx_ft_put(macsec_fs);
}
+static void macsec_fs_tx_del_rule(struct mlx5_macsec_fs *macsec_fs,
+ struct mlx5_macsec_tx_rule *tx_rule,
+ void *macdev)
+{
+ macsec_fs_id_del(&macsec_fs->macsec_devices_list, tx_rule->fs_id, macdev,
+ &macsec_fs->sci_hash, true);
+ macsec_fs_tx_free_rule(macsec_fs, tx_rule);
+}
+
#define MLX5_REFORMAT_PARAM_ADD_MACSEC_OFFSET_4_BYTES 1
static union mlx5_macsec_rule *
@@ -883,7 +888,7 @@ macsec_fs_tx_add_rule(struct mlx5_macsec_fs *macsec_fs,
goto out_spec;
err:
- macsec_fs_tx_del_rule(macsec_fs, tx_rule, macsec_ctx->secy->netdev);
+ macsec_fs_tx_free_rule(macsec_fs, tx_rule);
macsec_rule = NULL;
out_spec:
kvfree(spec);
@@ -1648,15 +1653,11 @@ static void macsec_fs_rx_ft_put(struct mlx5_macsec_fs *macsec_fs)
macsec_fs_rx_destroy(macsec_fs);
}
-static void macsec_fs_rx_del_rule(struct mlx5_macsec_fs *macsec_fs,
- struct mlx5_macsec_rx_rule *rx_rule,
- void *macdev, u32 fs_id)
+static void macsec_fs_rx_free_rule(struct mlx5_macsec_fs *macsec_fs,
+ struct mlx5_macsec_rx_rule *rx_rule)
{
int i;
- macsec_fs_id_del(&macsec_fs->macsec_devices_list, fs_id, macdev,
- &macsec_fs->fs_id_hash, false);
-
for (i = 0; i < RX_NUM_OF_RULES_PER_SA; ++i) {
if (rx_rule->rule[i]) {
mlx5_del_flow_rules(rx_rule->rule[i]);
@@ -1674,6 +1675,15 @@ static void macsec_fs_rx_del_rule(struct mlx5_macsec_fs *macsec_fs,
macsec_fs_rx_ft_put(macsec_fs);
}
+static void macsec_fs_rx_del_rule(struct mlx5_macsec_fs *macsec_fs,
+ struct mlx5_macsec_rx_rule *rx_rule,
+ void *macdev, u32 fs_id)
+{
+ macsec_fs_id_del(&macsec_fs->macsec_devices_list, fs_id, macdev,
+ &macsec_fs->fs_id_hash, false);
+ macsec_fs_rx_free_rule(macsec_fs, rx_rule);
+}
+
static void macsec_fs_rx_setup_fte(struct mlx5_flow_spec *spec,
struct mlx5_flow_act *flow_act,
struct mlx5_macsec_rule_attrs *attrs,
@@ -1833,7 +1843,7 @@ macsec_fs_rx_add_rule(struct mlx5_macsec_fs *macsec_fs,
return macsec_rule;
err:
- macsec_fs_rx_del_rule(macsec_fs, rx_rule, macsec_ctx->secy->netdev, fs_id);
+ macsec_fs_rx_free_rule(macsec_fs, rx_rule);
macsec_rule = NULL;
out_spec:
kvfree(spec);
base-commit: 6baae996ecf6a3f57b08ea6f6786e29af9260f51
--
2.43.0
reply other threads:[~2026-11-05 0:34 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261105003419.4016283-1-lcy8047@gmail.com \
--to=lcy8047@gmail.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@kernel.org \
--cc=horms@kernel.org \
--cc=joasantonio108@gmail.com \
--cc=kuba@kernel.org \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=mbloch@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=phaddad@nvidia.com \
--cc=saeedm@nvidia.com \
--cc=sd@queasysnail.net \
--cc=tariqt@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®