Re: [PATCH net 4/8] net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules

[Simon Horman <horms@kernel.org>]

On Wed, May 22, 2024 at 10:26:55PM +0300, Tariq Toukan wrote:
> From: Rahul Rameshbabu <rrameshbabu@nvidia.com>
> 
> rx_create no longer allocates a modify_hdr instance that needs to be
> cleaned up. The mlx5_modify_header_dealloc call will lead to a NULL pointer
> dereference. A leak in the rules also previously occurred since there are
> now two rules populated related to status.
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   #PF: supervisor read access in kernel mode
>   #PF: error_code(0x0000) - not-present page
>   PGD 109907067 P4D 109907067 PUD 116890067 PMD 0
>   Oops: 0000 [#1] SMP
>   CPU: 1 PID: 484 Comm: ip Not tainted 6.9.0-rc2-rrameshbabu+ #254
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.3-1-1 04/01/2014
>   RIP: 0010:mlx5_modify_header_dealloc+0xd/0x70
>   <snip>
>   Call Trace:
>    <TASK>
>    ? show_regs+0x60/0x70
>    ? __die+0x24/0x70
>    ? page_fault_oops+0x15f/0x430
>    ? free_to_partial_list.constprop.0+0x79/0x150
>    ? do_user_addr_fault+0x2c9/0x5c0
>    ? exc_page_fault+0x63/0x110
>    ? asm_exc_page_fault+0x27/0x30
>    ? mlx5_modify_header_dealloc+0xd/0x70
>    rx_create+0x374/0x590
>    rx_add_rule+0x3ad/0x500
>    ? rx_add_rule+0x3ad/0x500
>    ? mlx5_cmd_exec+0x2c/0x40
>    ? mlx5_create_ipsec_obj+0xd6/0x200
>    mlx5e_accel_ipsec_fs_add_rule+0x31/0xf0
>    mlx5e_xfrm_add_state+0x426/0xc00
>   <snip>
> 
> Fixes: 94af50c0a9bb ("net/mlx5e: Unify esw and normal IPsec status table creation/destruction")
> Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>

Reviewed-by: Simon Horman <horms@kernel.org>