Skip to content

Commit e9b797d

Browse files
kuba-mookuba-moo
committed
Merge tag 'mlx5-fixes-2023-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux
Saeed Mahameed says: ==================== mlx5 fixes 2023-12-13 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors net/mlx5e: Correct snprintf truncation handling for fw_version buffer net/mlx5e: Fix error codes in alloc_branch_attr() net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num net/mlx5: Fix fw tracer first block check net/mlx5e: XDP, Drop fragmented packets larger than MTU size net/mlx5e: Decrease num_block_tc when unblock tc offload net/mlx5e: Fix overrun reported by coverity net/mlx5e: fix a potential double-free in fs_udp_create_groups net/mlx5e: Fix a race in command alloc flow net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() net/mlx5e: fix double free of encap_header Revert "net/mlx5e: fix double free of encap_header" Revert "net/mlx5e: fix double free of encap_header in update funcs" ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2 parents 2c1a418 + b13559b commit e9b797d

File tree

15 files changed

+79
-54
lines changed

15 files changed

+79
-54
lines changed

‎drivers/net/ethernet/mellanox/mlx5/core/cmd.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -156,15 +156,18 @@ static u8 alloc_token(struct mlx5_cmd *cmd)
156156
return token;
157157
}
158158

159-
static int cmd_alloc_index(struct mlx5_cmd *cmd)
159+
static int cmd_alloc_index(struct mlx5_cmd *cmd, struct mlx5_cmd_work_ent *ent)
160160
{
161161
unsigned long flags;
162162
int ret;
163163

164164
spin_lock_irqsave(&cmd->alloc_lock, flags);
165165
ret = find_first_bit(&cmd->vars.bitmask, cmd->vars.max_reg_cmds);
166-
if (ret < cmd->vars.max_reg_cmds)
166+
if (ret < cmd->vars.max_reg_cmds) {
167167
clear_bit(ret, &cmd->vars.bitmask);
168+
ent->idx = ret;
169+
cmd->ent_arr[ent->idx] = ent;
170+
}
168171
spin_unlock_irqrestore(&cmd->alloc_lock, flags);
169172

170173
return ret < cmd->vars.max_reg_cmds ? ret : -ENOMEM;
@@ -979,7 +982,7 @@ static void cmd_work_handler(struct work_struct *work)
979982
sem = ent->page_queue ? &cmd->vars.pages_sem : &cmd->vars.sem;
980983
down(sem);
981984
if (!ent->page_queue) {
982-
alloc_ret = cmd_alloc_index(cmd);
985+
alloc_ret = cmd_alloc_index(cmd, ent);
983986
if (alloc_ret < 0) {
984987
mlx5_core_err_rl(dev, "failed to allocate command entry\n");
985988
if (ent->callback) {
@@ -994,15 +997,14 @@ static void cmd_work_handler(struct work_struct *work)
994997
up(sem);
995998
return;
996999
}
997-
ent->idx = alloc_ret;
9981000
} else {
9991001
ent->idx = cmd->vars.max_reg_cmds;
10001002
spin_lock_irqsave(&cmd->alloc_lock, flags);
10011003
clear_bit(ent->idx, &cmd->vars.bitmask);
1004+
cmd->ent_arr[ent->idx] = ent;
10021005
spin_unlock_irqrestore(&cmd->alloc_lock, flags);
10031006
}
10041007

1005-
cmd->ent_arr[ent->idx] = ent;
10061008
lay = get_inst(cmd, ent->idx);
10071009
ent->lay = lay;
10081010
memset(lay, 0, sizeof(*lay));

‎drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -718,7 +718,7 @@ static void mlx5_fw_tracer_handle_traces(struct work_struct *work)
718718

719719
while (block_timestamp > tracer->last_timestamp) {
720720
/* Check block override if it's not the first block */
721-
if (!tracer->last_timestamp) {
721+
if (tracer->last_timestamp) {
722722
u64 *ts_event;
723723
/* To avoid block override be the HW in case of buffer
724724
* wraparound, the time stamp of the previous block

‎drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ static int fs_udp_create_groups(struct mlx5e_flow_table *ft, enum fs_udp_type ty
154154
in = kvzalloc(inlen, GFP_KERNEL);
155155
if (!in || !ft->g) {
156156
kfree(ft->g);
157+
ft->g = NULL;
157158
kvfree(in);
158159
return -ENOMEM;
159160
}

‎drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@ parse_mirred_encap(struct mlx5e_tc_act_parse_state *parse_state,
197197
}
198198
esw_attr->dests[esw_attr->out_count].flags |= MLX5_ESW_DEST_ENCAP;
199199
esw_attr->out_count++;
200-
/* attr->dests[].rep is resolved when we handle encap */
200+
/* attr->dests[].vport is resolved when we handle encap */
201201

202202
return 0;
203203
}
@@ -270,7 +270,8 @@ parse_mirred(struct mlx5e_tc_act_parse_state *parse_state,
270270

271271
out_priv = netdev_priv(out_dev);
272272
rpriv = out_priv->ppriv;
273-
esw_attr->dests[esw_attr->out_count].rep = rpriv->rep;
273+
esw_attr->dests[esw_attr->out_count].vport_valid = true;
274+
esw_attr->dests[esw_attr->out_count].vport = rpriv->rep->vport;
274275
esw_attr->dests[esw_attr->out_count].mdev = out_priv->mdev;
275276

276277
esw_attr->out_count++;

‎drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c

Lines changed: 28 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,10 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
300300
if (err)
301301
goto destroy_neigh_entry;
302302

303+
e->encap_size = ipv4_encap_size;
304+
e->encap_header = encap_header;
305+
encap_header = NULL;
306+
303307
if (!(nud_state & NUD_VALID)) {
304308
neigh_event_send(attr.n, NULL);
305309
/* the encap entry will be made valid on neigh update event
@@ -310,17 +314,15 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
310314

311315
memset(&reformat_params, 0, sizeof(reformat_params));
312316
reformat_params.type = e->reformat_type;
313-
reformat_params.size = ipv4_encap_size;
314-
reformat_params.data = encap_header;
317+
reformat_params.size = e->encap_size;
318+
reformat_params.data = e->encap_header;
315319
e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, &reformat_params,
316320
MLX5_FLOW_NAMESPACE_FDB);
317321
if (IS_ERR(e->pkt_reformat)) {
318322
err = PTR_ERR(e->pkt_reformat);
319323
goto destroy_neigh_entry;
320324
}
321325

322-
e->encap_size = ipv4_encap_size;
323-
e->encap_header = encap_header;
324326
e->flags |= MLX5_ENCAP_ENTRY_VALID;
325327
mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
326328
mlx5e_route_lookup_ipv4_put(&attr);
@@ -403,29 +405,30 @@ int mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv *priv,
403405
if (err)
404406
goto free_encap;
405407

408+
e->encap_size = ipv4_encap_size;
409+
kfree(e->encap_header);
410+
e->encap_header = encap_header;
411+
encap_header = NULL;
412+
406413
if (!(nud_state & NUD_VALID)) {
407414
neigh_event_send(attr.n, NULL);
408415
/* the encap entry will be made valid on neigh update event
409416
* and not used before that.
410417
*/
411-
goto free_encap;
418+
goto release_neigh;
412419
}
413420

414421
memset(&reformat_params, 0, sizeof(reformat_params));
415422
reformat_params.type = e->reformat_type;
416-
reformat_params.size = ipv4_encap_size;
417-
reformat_params.data = encap_header;
423+
reformat_params.size = e->encap_size;
424+
reformat_params.data = e->encap_header;
418425
e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, &reformat_params,
419426
MLX5_FLOW_NAMESPACE_FDB);
420427
if (IS_ERR(e->pkt_reformat)) {
421428
err = PTR_ERR(e->pkt_reformat);
422429
goto free_encap;
423430
}
424431

425-
e->encap_size = ipv4_encap_size;
426-
kfree(e->encap_header);
427-
e->encap_header = encap_header;
428-
429432
e->flags |= MLX5_ENCAP_ENTRY_VALID;
430433
mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
431434
mlx5e_route_lookup_ipv4_put(&attr);
@@ -567,6 +570,10 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
567570
if (err)
568571
goto destroy_neigh_entry;
569572

573+
e->encap_size = ipv6_encap_size;
574+
e->encap_header = encap_header;
575+
encap_header = NULL;
576+
570577
if (!(nud_state & NUD_VALID)) {
571578
neigh_event_send(attr.n, NULL);
572579
/* the encap entry will be made valid on neigh update event
@@ -577,17 +584,15 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
577584

578585
memset(&reformat_params, 0, sizeof(reformat_params));
579586
reformat_params.type = e->reformat_type;
580-
reformat_params.size = ipv6_encap_size;
581-
reformat_params.data = encap_header;
587+
reformat_params.size = e->encap_size;
588+
reformat_params.data = e->encap_header;
582589
e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, &reformat_params,
583590
MLX5_FLOW_NAMESPACE_FDB);
584591
if (IS_ERR(e->pkt_reformat)) {
585592
err = PTR_ERR(e->pkt_reformat);
586593
goto destroy_neigh_entry;
587594
}
588595

589-
e->encap_size = ipv6_encap_size;
590-
e->encap_header = encap_header;
591596
e->flags |= MLX5_ENCAP_ENTRY_VALID;
592597
mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
593598
mlx5e_route_lookup_ipv6_put(&attr);
@@ -669,29 +674,30 @@ int mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv *priv,
669674
if (err)
670675
goto free_encap;
671676

677+
e->encap_size = ipv6_encap_size;
678+
kfree(e->encap_header);
679+
e->encap_header = encap_header;
680+
encap_header = NULL;
681+
672682
if (!(nud_state & NUD_VALID)) {
673683
neigh_event_send(attr.n, NULL);
674684
/* the encap entry will be made valid on neigh update event
675685
* and not used before that.
676686
*/
677-
goto free_encap;
687+
goto release_neigh;
678688
}
679689

680690
memset(&reformat_params, 0, sizeof(reformat_params));
681691
reformat_params.type = e->reformat_type;
682-
reformat_params.size = ipv6_encap_size;
683-
reformat_params.data = encap_header;
692+
reformat_params.size = e->encap_size;
693+
reformat_params.data = e->encap_header;
684694
e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, &reformat_params,
685695
MLX5_FLOW_NAMESPACE_FDB);
686696
if (IS_ERR(e->pkt_reformat)) {
687697
err = PTR_ERR(e->pkt_reformat);
688698
goto free_encap;
689699
}
690700

691-
e->encap_size = ipv6_encap_size;
692-
kfree(e->encap_header);
693-
e->encap_header = encap_header;
694-
695701
e->flags |= MLX5_ENCAP_ENTRY_VALID;
696702
mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
697703
mlx5e_route_lookup_ipv6_put(&attr);

‎drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1064,7 +1064,8 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
10641064

10651065
out_priv = netdev_priv(encap_dev);
10661066
rpriv = out_priv->ppriv;
1067-
esw_attr->dests[out_index].rep = rpriv->rep;
1067+
esw_attr->dests[out_index].vport_valid = true;
1068+
esw_attr->dests[out_index].vport = rpriv->rep->vport;
10681069
esw_attr->dests[out_index].mdev = out_priv->mdev;
10691070
}
10701071

‎drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -493,6 +493,7 @@ mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xmit_data *xdptxd,
493493
dma_addr_t dma_addr = xdptxd->dma_addr;
494494
u32 dma_len = xdptxd->len;
495495
u16 ds_cnt, inline_hdr_sz;
496+
unsigned int frags_size;
496497
u8 num_wqebbs = 1;
497498
int num_frags = 0;
498499
bool inline_ok;
@@ -503,8 +504,9 @@ mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xmit_data *xdptxd,
503504

504505
inline_ok = sq->min_inline_mode == MLX5_INLINE_MODE_NONE ||
505506
dma_len >= MLX5E_XDP_MIN_INLINE;
507+
frags_size = xdptxd->has_frags ? xdptxdf->sinfo->xdp_frags_size : 0;
506508

507-
if (unlikely(!inline_ok || sq->hw_mtu < dma_len)) {
509+
if (unlikely(!inline_ok || sq->hw_mtu < dma_len + frags_size)) {
508510
stats->err++;
509511
return false;
510512
}

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2142,7 +2142,7 @@ static int mlx5e_ipsec_block_tc_offload(struct mlx5_core_dev *mdev)
21422142

21432143
static void mlx5e_ipsec_unblock_tc_offload(struct mlx5_core_dev *mdev)
21442144
{
2145-
mdev->num_block_tc++;
2145+
mdev->num_block_tc--;
21462146
}
21472147

21482148
int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)

‎drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ void mlx5e_ethtool_get_drvinfo(struct mlx5e_priv *priv,
4949
count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
5050
"%d.%d.%04d (%.16s)", fw_rev_maj(mdev),
5151
fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id);
52-
if (count == sizeof(drvinfo->fw_version))
52+
if (count >= sizeof(drvinfo->fw_version))
5353
snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
5454
"%d.%d.%04d", fw_rev_maj(mdev),
5555
fw_rev_min(mdev), fw_rev_sub(mdev));

‎drivers/net/ethernet/mellanox/mlx5/core/en_rep.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ static void mlx5e_rep_get_drvinfo(struct net_device *dev,
7878
count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
7979
"%d.%d.%04d (%.16s)", fw_rev_maj(mdev),
8080
fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id);
81-
if (count == sizeof(drvinfo->fw_version))
81+
if (count >= sizeof(drvinfo->fw_version))
8282
snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
8383
"%d.%d.%04d", fw_rev_maj(mdev),
8484
fw_rev_min(mdev), fw_rev_sub(mdev));

‎drivers/net/ethernet/mellanox/mlx5/core/en_tc.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3778,7 +3778,8 @@ alloc_branch_attr(struct mlx5e_tc_flow *flow,
37783778
break;
37793779
case FLOW_ACTION_ACCEPT:
37803780
case FLOW_ACTION_PIPE:
3781-
if (set_branch_dest_ft(flow->priv, attr))
3781+
err = set_branch_dest_ft(flow->priv, attr);
3782+
if (err)
37823783
goto out_err;
37833784
break;
37843785
case FLOW_ACTION_JUMP:
@@ -3788,7 +3789,8 @@ alloc_branch_attr(struct mlx5e_tc_flow *flow,
37883789
goto out_err;
37893790
}
37903791
*jump_count = cond->extval;
3791-
if (set_branch_dest_ft(flow->priv, attr))
3792+
err = set_branch_dest_ft(flow->priv, attr);
3793+
if (err)
37923794
goto out_err;
37933795
break;
37943796
default:
@@ -5736,8 +5738,10 @@ int mlx5e_tc_action_miss_mapping_get(struct mlx5e_priv *priv, struct mlx5_flow_a
57365738

57375739
esw = priv->mdev->priv.eswitch;
57385740
attr->act_id_restore_rule = esw_add_restore_rule(esw, *act_miss_mapping);
5739-
if (IS_ERR(attr->act_id_restore_rule))
5741+
if (IS_ERR(attr->act_id_restore_rule)) {
5742+
err = PTR_ERR(attr->act_id_restore_rule);
57405743
goto err_rule;
5744+
}
57415745

57425746
return 0;
57435747

‎drivers/net/ethernet/mellanox/mlx5/core/eswitch.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -526,7 +526,8 @@ struct mlx5_esw_flow_attr {
526526
u8 total_vlan;
527527
struct {
528528
u32 flags;
529-
struct mlx5_eswitch_rep *rep;
529+
bool vport_valid;
530+
u16 vport;
530531
struct mlx5_pkt_reformat *pkt_reformat;
531532
struct mlx5_core_dev *mdev;
532533
struct mlx5_termtbl_handle *termtbl;

0 commit comments

Comments
 (0)