* [bug report] net/mlx5: Change TTC rules to match on undecrypted ESP packets
@ 2026-07-10 9:41 Dan Carpenter
2026-07-10 10:04 ` Jianbo Liu
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2026-07-10 9:41 UTC (permalink / raw)
To: Jianbo Liu; +Cc: linux-rdma
Hello Jianbo Liu,
Commit 9f24f0c4d4dd ("net/mlx5: Change TTC rules to match on
undecrypted ESP packets") from Sep 18, 2025 (linux-next), leads to
the following Smatch static checker warning:
drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c:614 mlx5_create_ttc_table_groups()
warn: passing zero to 'PTR_ERR'
drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
529 static int mlx5_create_ttc_table_groups(struct mlx5_ttc_table *ttc,
530 bool use_ipv)
531 {
532 const struct mlx5_fs_ttc_groups *groups = ttc->groups;
533 int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
534 int ix = 0;
535 u32 *in;
536 int err;
537 u8 *mc;
538
539 ttc->g = kzalloc_objs(*ttc->g, groups->num_groups);
540 if (!ttc->g)
541 return -ENOMEM;
542 in = kvzalloc(inlen, GFP_KERNEL);
543 if (!in) {
544 kfree(ttc->g);
545 ttc->g = NULL;
546 return -ENOMEM;
547 }
548
549 mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
550 if (use_ipv)
551 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ip_version);
552 else
553 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ethertype);
554 MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
555
556 /* TCP UDP group */
557 if (groups->use_l4_type) {
558 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.l4_type);
559 MLX5_SET_CFG(in, start_flow_index, ix);
560 ix += groups->group_size[ttc->num_groups];
561 MLX5_SET_CFG(in, end_flow_index, ix - 1);
562 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
563 if (IS_ERR(ttc->g[ttc->num_groups]))
564 goto err;
565 ttc->num_groups++;
566
567 MLX5_SET(fte_match_param, mc, outer_headers.l4_type, 0);
568 }
569
570 /* L4 Group */
571 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ip_protocol);
572 MLX5_SET_CFG(in, start_flow_index, ix);
573 ix += groups->group_size[ttc->num_groups];
574 MLX5_SET_CFG(in, end_flow_index, ix - 1);
575 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
576 if (IS_ERR(ttc->g[ttc->num_groups]))
577 goto err;
578 ttc->num_groups++;
579
580 if (mlx5_ttc_has_esp_flow_group(ttc)) {
581 err = mlx5_create_ttc_table_ipsec_groups(ttc, use_ipv, in, &ix);
582 if (err)
583 goto err;
The error code is supposed to stored in ttc->g[ttc->num_groups].
(don't look at me, I didn't invent the rules).
584
585 MLX5_SET(fte_match_param, mc,
586 misc_parameters_2.ipsec_next_header, 0);
587 }
588
589 /* L3 Group */
590 MLX5_SET(fte_match_param, mc, outer_headers.ip_protocol, 0);
591 MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
592 MLX5_SET_CFG(in, start_flow_index, ix);
593 ix += groups->group_size[ttc->num_groups];
594 MLX5_SET_CFG(in, end_flow_index, ix - 1);
595 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
596 if (IS_ERR(ttc->g[ttc->num_groups]))
597 goto err;
598 ttc->num_groups++;
599
600 /* Any Group */
601 memset(in, 0, inlen);
602 MLX5_SET_CFG(in, start_flow_index, ix);
603 ix += groups->group_size[ttc->num_groups];
604 MLX5_SET_CFG(in, end_flow_index, ix - 1);
605 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
606 if (IS_ERR(ttc->g[ttc->num_groups]))
607 goto err;
608 ttc->num_groups++;
609
610 kvfree(in);
611 return 0;
612
613 err:
--> 614 err = PTR_ERR(ttc->g[ttc->num_groups]);
615 ttc->g[ttc->num_groups] = NULL;
616 kvfree(in);
617
618 return err;
619 }
This email is a free service from the Smatch-CI project [smatch.sf.net].
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [bug report] net/mlx5: Change TTC rules to match on undecrypted ESP packets
2026-07-10 9:41 [bug report] net/mlx5: Change TTC rules to match on undecrypted ESP packets Dan Carpenter
@ 2026-07-10 10:04 ` Jianbo Liu
2026-07-10 11:30 ` Dan Carpenter
0 siblings, 1 reply; 3+ messages in thread
From: Jianbo Liu @ 2026-07-10 10:04 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-rdma
Thanks for the report.
This appears to be a false positive. On every failure path in
mlx5_create_ttc_table_ipsec_groups(), mlx5_create_flow_group() stores an
ERR_PTR in:
ttc->g[ttc->num_groups]
The helper increments ttc->num_groups only after successful group
creation.
Therefore, when the helper returns an error, ttc->num_groups still
identifies
the failed entry and that entry contains the same ERR_PTR. It remains
unchanged before the shared error label calls PTR_ERR().
Thanks,
Jianbo
On 7/10/2026 5:41 PM, Dan Carpenter wrote:
> Hello Jianbo Liu,
>
> Commit 9f24f0c4d4dd ("net/mlx5: Change TTC rules to match on
> undecrypted ESP packets") from Sep 18, 2025 (linux-next), leads to
> the following Smatch static checker warning:
>
> drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c:614 mlx5_create_ttc_table_groups()
> warn: passing zero to 'PTR_ERR'
>
> drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> 529 static int mlx5_create_ttc_table_groups(struct mlx5_ttc_table *ttc,
> 530 bool use_ipv)
> 531 {
> 532 const struct mlx5_fs_ttc_groups *groups = ttc->groups;
> 533 int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
> 534 int ix = 0;
> 535 u32 *in;
> 536 int err;
> 537 u8 *mc;
> 538
> 539 ttc->g = kzalloc_objs(*ttc->g, groups->num_groups);
> 540 if (!ttc->g)
> 541 return -ENOMEM;
> 542 in = kvzalloc(inlen, GFP_KERNEL);
> 543 if (!in) {
> 544 kfree(ttc->g);
> 545 ttc->g = NULL;
> 546 return -ENOMEM;
> 547 }
> 548
> 549 mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
> 550 if (use_ipv)
> 551 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ip_version);
> 552 else
> 553 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ethertype);
> 554 MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
> 555
> 556 /* TCP UDP group */
> 557 if (groups->use_l4_type) {
> 558 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.l4_type);
> 559 MLX5_SET_CFG(in, start_flow_index, ix);
> 560 ix += groups->group_size[ttc->num_groups];
> 561 MLX5_SET_CFG(in, end_flow_index, ix - 1);
> 562 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
> 563 if (IS_ERR(ttc->g[ttc->num_groups]))
> 564 goto err;
> 565 ttc->num_groups++;
> 566
> 567 MLX5_SET(fte_match_param, mc, outer_headers.l4_type, 0);
> 568 }
> 569
> 570 /* L4 Group */
> 571 MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ip_protocol);
> 572 MLX5_SET_CFG(in, start_flow_index, ix);
> 573 ix += groups->group_size[ttc->num_groups];
> 574 MLX5_SET_CFG(in, end_flow_index, ix - 1);
> 575 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
> 576 if (IS_ERR(ttc->g[ttc->num_groups]))
> 577 goto err;
> 578 ttc->num_groups++;
> 579
> 580 if (mlx5_ttc_has_esp_flow_group(ttc)) {
> 581 err = mlx5_create_ttc_table_ipsec_groups(ttc, use_ipv, in, &ix);
> 582 if (err)
> 583 goto err;
>
>
> The error code is supposed to stored in ttc->g[ttc->num_groups].
> (don't look at me, I didn't invent the rules).
>
> 584
> 585 MLX5_SET(fte_match_param, mc,
> 586 misc_parameters_2.ipsec_next_header, 0);
> 587 }
> 588
> 589 /* L3 Group */
> 590 MLX5_SET(fte_match_param, mc, outer_headers.ip_protocol, 0);
> 591 MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
> 592 MLX5_SET_CFG(in, start_flow_index, ix);
> 593 ix += groups->group_size[ttc->num_groups];
> 594 MLX5_SET_CFG(in, end_flow_index, ix - 1);
> 595 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
> 596 if (IS_ERR(ttc->g[ttc->num_groups]))
> 597 goto err;
> 598 ttc->num_groups++;
> 599
> 600 /* Any Group */
> 601 memset(in, 0, inlen);
> 602 MLX5_SET_CFG(in, start_flow_index, ix);
> 603 ix += groups->group_size[ttc->num_groups];
> 604 MLX5_SET_CFG(in, end_flow_index, ix - 1);
> 605 ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in);
> 606 if (IS_ERR(ttc->g[ttc->num_groups]))
> 607 goto err;
> 608 ttc->num_groups++;
> 609
> 610 kvfree(in);
> 611 return 0;
> 612
> 613 err:
> --> 614 err = PTR_ERR(ttc->g[ttc->num_groups]);
> 615 ttc->g[ttc->num_groups] = NULL;
> 616 kvfree(in);
> 617
> 618 return err;
> 619 }
>
> This email is a free service from the Smatch-CI project [smatch.sf.net].
>
> regards,
> dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [bug report] net/mlx5: Change TTC rules to match on undecrypted ESP packets
2026-07-10 10:04 ` Jianbo Liu
@ 2026-07-10 11:30 ` Dan Carpenter
0 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2026-07-10 11:30 UTC (permalink / raw)
To: Jianbo Liu; +Cc: linux-rdma
On Fri, Jul 10, 2026 at 06:04:35PM +0800, Jianbo Liu wrote:
> Thanks for the report.
>
> This appears to be a false positive. On every failure path in
> mlx5_create_ttc_table_ipsec_groups(), mlx5_create_flow_group() stores an
> ERR_PTR in:
>
> ttc->g[ttc->num_groups]
>
> The helper increments ttc->num_groups only after successful group
> creation.
> Therefore, when the helper returns an error, ttc->num_groups still
> identifies
> the failed entry and that entry contains the same ERR_PTR. It remains
> unchanged before the shared error label calls PTR_ERR().
>
Ah, yes. Thanks. I should have checked... :/
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-10 11:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-10 9:41 [bug report] net/mlx5: Change TTC rules to match on undecrypted ESP packets Dan Carpenter
2026-07-10 10:04 ` Jianbo Liu
2026-07-10 11:30 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox