Re: [PATCH net] net/mlx5: fs, fix invalid pointer dereference in mlx5_fs_add_rule tracepoint

[Moshe Shemesh <moshe@nvidia.com>]

On 3/28/2026 10:20 PM, kenneth@bridgetech.tv wrote:
> 
> The mlx5_fs_add_rule tracepoint has used the flow destination type in
> a bitwise test since its introduction. However, that's not a valid way
> to treat it anymore (if it ever was), and after commit d639af621600dc
> ("net/mlx5: fs, split software and IFC flow destination definitions"),
> this mismatch caused nearly any destination type to be mistaken as a
> flow counter, and thus stashing 32 bits of the mlx5_flow_destination
> union into the counter_id field of the tracepoint.
> 
> Later commit 95f68e06b41b9e ("net/mlx5: fs, add counter object to flow
> destination") exacerbates this issue by converting the counter union
> member from an integer to a pointer. Now the tracepoint dereferences
> whichever value is in the union, and in cases where that's not a valid
> pointer, it can lead to a kernel oops.
> 
> Fix the check. Reported by GitHub user whi71800.
> 
> Cc:stable@vger.kernel.org
> Fixes: 95f68e06b41b9e ("net/mlx5: fs, add counter object to flow destination")
> Closes:https://github.com/knneth/mlnx-ofa_kernel/issues/1
> Signed-off-by: Kenneth Klette Jonassen<kenneth@bridgetech.tv>

Reviewed-by: Moshe Shemesh <moshe@nvidia.com>

Thanks.