[PATCH] net/mlx5e: TC, release meter if rule offload fails

[PATCH] net/mlx5e: TC, release meter if rule offload fails

[Wentao Liang]

mlx5e_tc_rule_offload() adds the flow meter to the attribute and then
adds the offloaded rule. If mlx5_eswitch_add_offloaded_rule() fails, the
meter reference taken by mlx5e_tc_add_flow_meter() is not dropped.

The error propagates to mlx5e_tc_add_fdb_flow() and the flow is freed
without the OFFLOADED flag, so mlx5e_tc_rule_unoffload() and
mlx5e_tc_del_flow_meter() are never called. Release the meter and the
post meter state in the failure path of mlx5e_tc_rule_offload() itself.

Fixes: a8d52b024d6d ("net/mlx5e: TC, Support offloading police action")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 708b7987ea4c..17bd92529a44 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -491,6 +491,8 @@ mlx5e_tc_rule_offload(struct mlx5e_priv *priv,
 		      struct mlx5_flow_attr *attr)
 {
 	struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+	struct mlx5_flow_handle *rule;
+	bool meter_added = false;
 	int err;
 
 	if (!is_mdev_switchdev_mode(priv->mdev))
@@ -503,9 +505,14 @@ mlx5e_tc_rule_offload(struct mlx5e_priv *priv,
 		err = mlx5e_tc_add_flow_meter(priv, attr);
 		if (err)
 			return ERR_PTR(err);
+		meter_added = true;
 	}
 
-	return mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
+	rule = mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
+	if (IS_ERR(rule) && meter_added)
+		mlx5e_tc_del_flow_meter(esw, attr);
+
+	return rule;
 }
 
 void
-- 
2.34.1

Re: [PATCH] net/mlx5e: TC, release meter if rule offload fails

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] net/mlx5e: TC, release meter if rule offload fails

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net/mlx5e: TC, dangling meter pointers after mlx5e_tc_del_flow_meter()
--

commit b953a898af94c9215dfc36d4dbe7f5054db010fd
Author: Wentao Liang <vulab@iscas.ac.cn>

net/mlx5e: TC, release meter if rule offload fails

This commit cleans up the flow meter and post-meter state in
mlx5e_tc_rule_offload() if mlx5_eswitch_add_offloaded_rule() fails after
mlx5e_tc_add_flow_meter() has succeeded.

> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 708b7987ea4cd..17bd92529a44a 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> @@ -491,6 +491,8 @@ mlx5e_tc_rule_offload(struct mlx5e_priv *priv,
>  		      struct mlx5_flow_attr *attr)
>  {
>  	struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
> +	struct mlx5_flow_handle *rule;
> +	bool meter_added = false;
>  	int err;
>  
>  	if (!is_mdev_switchdev_mode(priv->mdev))
> @@ -503,9 +505,14 @@ mlx5e_tc_rule_offload(struct mlx5e_priv *priv,
>  		err = mlx5e_tc_add_flow_meter(priv, attr);
>  		if (err)
>  			return ERR_PTR(err);
> +		meter_added = true;
>  	}
>  
> -	return mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
> +	rule = mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
> +	if (IS_ERR(rule) && meter_added)
> +		mlx5e_tc_del_flow_meter(esw, attr);

[Severity: High]
Does calling mlx5e_tc_del_flow_meter() here leave dangling pointers in
attr->meter_attr.meter, attr->meter_attr.post_meter, and attr->dest_ft that
can lead to a use-after-free or double-free when the flow is not immediately
freed?

In drivers/net/ethernet/mellanox/mlx5/core/en_tc.c,
mlx5e_tc_add_flow_meter() populates attr and mlx5e_tc_del_flow_meter()
releases the resources without clearing those fields:

mlx5e_tc_add_flow_meter() {
	...
	attr->meter_attr.meter = meter;
	attr->meter_attr.post_meter = post_meter;
	attr->dest_ft = mlx5e_post_meter_get_ft(post_meter);
	attr->action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
	return 0;
}

mlx5e_tc_del_flow_meter() {
	mlx5e_post_meter_cleanup(esw, attr->meter_attr.post_meter);
	mlx5e_tc_meter_put(attr->meter_attr.meter);
}

While mlx5e_tc_add_fdb_flow() frees the flow on error, other callers keep
flow->attr alive when mlx5e_tc_offload_fdb_rules() ->
mlx5e_tc_rule_offload() fails.

For example, in drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c,
mlx5e_reoffload_encap() keeps the flow and still sets the OFFLOADED flag:

mlx5e_reoffload_encap() {
	...
			rule = mlx5e_tc_offload_fdb_rules(esw, flow, spec, flow->attr);
			if (IS_ERR(rule)) {
				mlx5e_tc_unoffload_flow_post_acts(flow);
				err = PTR_ERR(rule);
				mlx5_core_warn(priv->mdev, "Failed to update cached encapsulation flow, %d\n",
					       err);
			} else {
				flow->rule[0] = rule;
			}
		} else {
			...
		}
		flow_flag_set(flow, OFFLOADED);
}

When that flow is later deleted or invalidated via
mlx5e_tc_unoffload_fdb_rules() -> mlx5e_tc_rule_unoffload():

mlx5e_tc_rule_unoffload() {
	...
	if (attr->meter_attr.meter)
		mlx5e_tc_del_flow_meter(esw, attr);
}

attr->meter_attr.meter is still non-NULL, so mlx5e_tc_del_flow_meter() is
called a second time on the already-cleaned-up post_meter and meter.

Similarly, if mlx5e_tc_offload_fdb_rules() fails in
mlx5e_tc_encap_flows_add(), the flow remains on the slow path with a
dangling non-NULL flow->attr->dest_ft. When
mlx5e_tc_unoffload_from_slow_path() later copies flow->attr into slow_attr
and calls mlx5e_tc_unoffload_fdb_rules() -> mlx5e_tc_rule_unoffload() ->
mlx5_eswitch_del_offloaded_rule() -> esw_cleanup_dests(), the non-NULL
attr->dest_ft causes esw_cleanup_dests() to take the attr->dest_ft branch on
a slow-path rule.

Should mlx5e_tc_del_flow_meter() (or the error path in
mlx5e_tc_rule_offload()) also clear attr->meter_attr.meter,
attr->meter_attr.post_meter, and attr->dest_ft?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103102856.1340672-1-vulab@iscas.ac.cn?part=1