Re: [bug report] net/mlx5: Change TTC rules to match on undecrypted ESP packets

[Jianbo Liu <jianbol@nvidia.com>]

   Thanks for the report.

   This appears to be a false positive. On every failure path in
   mlx5_create_ttc_table_ipsec_groups(), mlx5_create_flow_group() stores an
   ERR_PTR in:

       ttc->g[ttc->num_groups]

   The helper increments ttc->num_groups only after successful group 
creation.
   Therefore, when the helper returns an error, ttc->num_groups still 
identifies
   the failed entry and that entry contains the same ERR_PTR. It remains
   unchanged before the shared error label calls PTR_ERR().

   Thanks,
   Jianbo

On 7/10/2026 5:41 PM, Dan Carpenter wrote:

> Hello Jianbo Liu,
>
> Commit 9f24f0c4d4dd ("net/mlx5: Change TTC rules to match on
> undecrypted ESP packets") from Sep 18, 2025 (linux-next), leads to
> the following Smatch static checker warning:
>
> 	drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c:614 mlx5_create_ttc_table_groups()
> 	warn: passing zero to 'PTR_ERR'
>
> drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
>      529 static int mlx5_create_ttc_table_groups(struct mlx5_ttc_table *ttc,
>      530                                         bool use_ipv)
>      531 {
>      532         const struct mlx5_fs_ttc_groups *groups = ttc->groups;
>      533         int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
>      534         int ix = 0;
>      535         u32 *in;
>      536         int err;
>      537         u8 *mc;
>      538
>      539         ttc->g = kzalloc_objs(*ttc->g, groups->num_groups);
>      540         if (!ttc->g)
>      541                 return -ENOMEM;
>      542         in = kvzalloc(inlen, GFP_KERNEL);
>      543         if (!in) {
>      544                 kfree(ttc->g);
>      545                 ttc->g = NULL;
>      546                 return -ENOMEM;
>      547         }
>      548
>      549         mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
>      550         if (use_ipv)
>      551                 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ip_version);
>      552         else
>      553                 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ethertype);
>      554         MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
>      555
>      556         /* TCP UDP group */
>      557         if (groups->use_l4_type) {
>      558                 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.l4_type);
>      559                 MLX5_SET_CFG(in, start_flow_index, ix);
>      560                 ix += groups->group_size[ttc->num_groups];
>      561                 MLX5_SET_CFG(in, end_flow_index, ix - 1);
>      562                 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
>      563                 if (IS_ERR(ttc->g[ttc->num_groups]))
>      564                         goto err;
>      565                 ttc->num_groups++;
>      566
>      567                 MLX5_SET(fte_match_param, mc, outer_headers.l4_type, 0);
>      568         }
>      569
>      570         /* L4 Group */
>      571         MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ip_protocol);
>      572         MLX5_SET_CFG(in, start_flow_index, ix);
>      573         ix += groups->group_size[ttc->num_groups];
>      574         MLX5_SET_CFG(in, end_flow_index, ix - 1);
>      575         ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
>      576         if (IS_ERR(ttc->g[ttc->num_groups]))
>      577                 goto err;
>      578         ttc->num_groups++;
>      579
>      580         if (mlx5_ttc_has_esp_flow_group(ttc)) {
>      581                 err = mlx5_create_ttc_table_ipsec_groups(ttc, use_ipv, in, &ix);
>      582                 if (err)
>      583                         goto err;
>
>
> The error code is supposed to stored in ttc->g[ttc->num_groups].
> (don't look at me, I didn't invent the rules).
>
>      584
>      585                 MLX5_SET(fte_match_param, mc,
>      586                          misc_parameters_2.ipsec_next_header, 0);
>      587         }
>      588
>      589         /* L3 Group */
>      590         MLX5_SET(fte_match_param, mc, outer_headers.ip_protocol, 0);
>      591         MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
>      592         MLX5_SET_CFG(in, start_flow_index, ix);
>      593         ix += groups->group_size[ttc->num_groups];
>      594         MLX5_SET_CFG(in, end_flow_index, ix - 1);
>      595         ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
>      596         if (IS_ERR(ttc->g[ttc->num_groups]))
>      597                 goto err;
>      598         ttc->num_groups++;
>      599
>      600         /* Any Group */
>      601         memset(in, 0, inlen);
>      602         MLX5_SET_CFG(in, start_flow_index, ix);
>      603         ix += groups->group_size[ttc->num_groups];
>      604         MLX5_SET_CFG(in, end_flow_index, ix - 1);
>      605         ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
>      606         if (IS_ERR(ttc->g[ttc->num_groups]))
>      607                 goto err;
>      608         ttc->num_groups++;
>      609
>      610         kvfree(in);
>      611         return 0;
>      612
>      613 err:
> --> 614         err = PTR_ERR(ttc->g[ttc->num_groups]);
>      615         ttc->g[ttc->num_groups] = NULL;
>      616         kvfree(in);
>      617
>      618         return err;
>      619 }
>
> This email is a free service from the Smatch-CI project [smatch.sf.net].
>
> regards,
> dan carpenter