[PATCH mlx5-next v1] net/mlx5: Check device memory pointer before usage

[PATCH mlx5-next v1] net/mlx5: Check device memory pointer before usage

[Leon Romanovsky]

From: Stav Aviram <saviram@nvidia.com>

Add a NULL check before accessing device memory to prevent a crash if
dev->dm allocation in mlx5_init_once() fails.

Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core")
Signed-off-by: Stav Aviram <saviram@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
Changelog:
v1:
 * Removed extra IS_ERR(dm) check.
v0:
https://lore.kernel.org/all/e389fa6ef075af1049cd7026b912d736ebe3ad23.1751279408.git.leonro@nvidia.com
---
 drivers/infiniband/hw/mlx5/dm.c                  | 2 +-
 drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++--
 drivers/net/ethernet/mellanox/mlx5/core/main.c   | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c
index b4c97fb62abf..9ded2b7c1e31 100644
--- a/drivers/infiniband/hw/mlx5/dm.c
+++ b/drivers/infiniband/hw/mlx5/dm.c
@@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx,
 	int err;
 	u64 address;
 
-	if (!MLX5_CAP_DEV_MEM(dm_db->dev, memic))
+	if (!dm_db || !MLX5_CAP_DEV_MEM(dm_db->dev, memic))
 		return ERR_PTR(-EOPNOTSUPP);
 
 	dm = kzalloc(sizeof(*dm), GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c
index 7c5516b0a844..8115071c34a4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c
@@ -30,7 +30,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev)
 
 	dm = kzalloc(sizeof(*dm), GFP_KERNEL);
 	if (!dm)
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 
 	spin_lock_init(&dm->lock);
 
@@ -96,7 +96,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev)
 err_steering:
 	kfree(dm);
 
-	return ERR_PTR(-ENOMEM);
+	return NULL;
 }
 
 void mlx5_dm_cleanup(struct mlx5_core_dev *dev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 41e8660c819c..e9baf4221cde 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1102,7 +1102,7 @@ static int mlx5_init_once(struct mlx5_core_dev *dev)
 	}
 
 	dev->dm = mlx5_dm_create(dev);
-	if (IS_ERR(dev->dm))
+	if (!dev->dm)
 		mlx5_core_warn(dev, "Failed to init device memory %ld\n", PTR_ERR(dev->dm));
 
 	dev->tracer = mlx5_fw_tracer_create(dev);
-- 
2.50.0

Re: [PATCH mlx5-next v1] net/mlx5: Check device memory pointer before usage

[Simon Horman]

On Tue, Jul 01, 2025 at 03:08:12PM +0300, Leon Romanovsky wrote:
> From: Stav Aviram <saviram@nvidia.com>
> 
> Add a NULL check before accessing device memory to prevent a crash if
> dev->dm allocation in mlx5_init_once() fails.
> 
> Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core")
> Signed-off-by: Stav Aviram <saviram@nvidia.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
> Changelog:
> v1:
>  * Removed extra IS_ERR(dm) check.
> v0:
> https://lore.kernel.org/all/e389fa6ef075af1049cd7026b912d736ebe3ad23.1751279408.git.leonro@nvidia.com
> ---
>  drivers/infiniband/hw/mlx5/dm.c                  | 2 +-
>  drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++--
>  drivers/net/ethernet/mellanox/mlx5/core/main.c   | 2 +-
>  3 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c
> index b4c97fb62abf..9ded2b7c1e31 100644
> --- a/drivers/infiniband/hw/mlx5/dm.c
> +++ b/drivers/infiniband/hw/mlx5/dm.c
> @@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx,
>  	int err;
>  	u64 address;
>  
> -	if (!MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> +	if (!dm_db || !MLX5_CAP_DEV_MEM(dm_db->dev, memic))
>  		return ERR_PTR(-EOPNOTSUPP);

nit: -EOPNOTSUPP doesn't feel like the right error code
     in the !dm_db case.

>  
>  	dm = kzalloc(sizeof(*dm), GFP_KERNEL);

...

Re: [PATCH mlx5-next v1] net/mlx5: Check device memory pointer before usage

[Leon Romanovsky]

On Tue, Jul 01, 2025 at 08:38:58PM +0100, Simon Horman wrote:
> On Tue, Jul 01, 2025 at 03:08:12PM +0300, Leon Romanovsky wrote:
> > From: Stav Aviram <saviram@nvidia.com>
> > 
> > Add a NULL check before accessing device memory to prevent a crash if
> > dev->dm allocation in mlx5_init_once() fails.
> > 
> > Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core")
> > Signed-off-by: Stav Aviram <saviram@nvidia.com>
> > Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> > ---
> > Changelog:
> > v1:
> >  * Removed extra IS_ERR(dm) check.
> > v0:
> > https://lore.kernel.org/all/e389fa6ef075af1049cd7026b912d736ebe3ad23.1751279408.git.leonro@nvidia.com
> > ---
> >  drivers/infiniband/hw/mlx5/dm.c                  | 2 +-
> >  drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++--
> >  drivers/net/ethernet/mellanox/mlx5/core/main.c   | 2 +-
> >  3 files changed, 4 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c
> > index b4c97fb62abf..9ded2b7c1e31 100644
> > --- a/drivers/infiniband/hw/mlx5/dm.c
> > +++ b/drivers/infiniband/hw/mlx5/dm.c
> > @@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx,
> >  	int err;
> >  	u64 address;
> >  
> > -	if (!MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> > +	if (!dm_db || !MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> >  		return ERR_PTR(-EOPNOTSUPP);
> 
> nit: -EOPNOTSUPP doesn't feel like the right error code
>      in the !dm_db case.

Why? This error is returned to the user through mlx5_ib_alloc_dm().

Thanks

> 
> >  
> >  	dm = kzalloc(sizeof(*dm), GFP_KERNEL);
> 
> ...

Re: [PATCH mlx5-next v1] net/mlx5: Check device memory pointer before usage

[Simon Horman]

On Wed, Jul 02, 2025 at 11:28:47AM +0300, Leon Romanovsky wrote:
> On Tue, Jul 01, 2025 at 08:38:58PM +0100, Simon Horman wrote:
> > On Tue, Jul 01, 2025 at 03:08:12PM +0300, Leon Romanovsky wrote:
> > > From: Stav Aviram <saviram@nvidia.com>
> > > 
> > > Add a NULL check before accessing device memory to prevent a crash if
> > > dev->dm allocation in mlx5_init_once() fails.
> > > 
> > > Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core")
> > > Signed-off-by: Stav Aviram <saviram@nvidia.com>
> > > Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> > > ---
> > > Changelog:
> > > v1:
> > >  * Removed extra IS_ERR(dm) check.
> > > v0:
> > > https://lore.kernel.org/all/e389fa6ef075af1049cd7026b912d736ebe3ad23.1751279408.git.leonro@nvidia.com
> > > ---
> > >  drivers/infiniband/hw/mlx5/dm.c                  | 2 +-
> > >  drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++--
> > >  drivers/net/ethernet/mellanox/mlx5/core/main.c   | 2 +-
> > >  3 files changed, 4 insertions(+), 4 deletions(-)
> > > 
> > > diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c
> > > index b4c97fb62abf..9ded2b7c1e31 100644
> > > --- a/drivers/infiniband/hw/mlx5/dm.c
> > > +++ b/drivers/infiniband/hw/mlx5/dm.c
> > > @@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx,
> > >  	int err;
> > >  	u64 address;
> > >  
> > > -	if (!MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> > > +	if (!dm_db || !MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> > >  		return ERR_PTR(-EOPNOTSUPP);
> > 
> > nit: -EOPNOTSUPP doesn't feel like the right error code
> >      in the !dm_db case.
> 
> Why? This error is returned to the user through mlx5_ib_alloc_dm().

Because, as I understand things, such a case would be due to a memory
allocation failure, not by the device not supporting a feature.

handle_alloc_dm_memic() already returns ERR_PTR(-ENOMEM) if kzalloc() fails.
I'd suggest doing so for the !dm_db case too.

But I don't feel particularly strongly about this.

Re: [PATCH mlx5-next v1] net/mlx5: Check device memory pointer before usage

[Leon Romanovsky]

On Wed, Jul 02, 2025 at 03:07:35PM +0100, Simon Horman wrote:
> On Wed, Jul 02, 2025 at 11:28:47AM +0300, Leon Romanovsky wrote:
> > On Tue, Jul 01, 2025 at 08:38:58PM +0100, Simon Horman wrote:
> > > On Tue, Jul 01, 2025 at 03:08:12PM +0300, Leon Romanovsky wrote:
> > > > From: Stav Aviram <saviram@nvidia.com>
> > > > 
> > > > Add a NULL check before accessing device memory to prevent a crash if
> > > > dev->dm allocation in mlx5_init_once() fails.
> > > > 
> > > > Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core")
> > > > Signed-off-by: Stav Aviram <saviram@nvidia.com>
> > > > Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> > > > ---
> > > > Changelog:
> > > > v1:
> > > >  * Removed extra IS_ERR(dm) check.
> > > > v0:
> > > > https://lore.kernel.org/all/e389fa6ef075af1049cd7026b912d736ebe3ad23.1751279408.git.leonro@nvidia.com
> > > > ---
> > > >  drivers/infiniband/hw/mlx5/dm.c                  | 2 +-
> > > >  drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++--
> > > >  drivers/net/ethernet/mellanox/mlx5/core/main.c   | 2 +-
> > > >  3 files changed, 4 insertions(+), 4 deletions(-)
> > > > 
> > > > diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c
> > > > index b4c97fb62abf..9ded2b7c1e31 100644
> > > > --- a/drivers/infiniband/hw/mlx5/dm.c
> > > > +++ b/drivers/infiniband/hw/mlx5/dm.c
> > > > @@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx,
> > > >  	int err;
> > > >  	u64 address;
> > > >  
> > > > -	if (!MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> > > > +	if (!dm_db || !MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> > > >  		return ERR_PTR(-EOPNOTSUPP);
> > > 
> > > nit: -EOPNOTSUPP doesn't feel like the right error code
> > >      in the !dm_db case.
> > 
> > Why? This error is returned to the user through mlx5_ib_alloc_dm().
> 
> Because, as I understand things, such a case would be due to a memory
> allocation failure, not by the device not supporting a feature.
> 
> handle_alloc_dm_memic() already returns ERR_PTR(-ENOMEM) if kzalloc() fails.
> I'd suggest doing so for the !dm_db case too.

!dm_db case can be because of missing capabilities and EOPNOTSUPP is a
way to inform users about it.

> 
> But I don't feel particularly strongly about this.

Re: [PATCH mlx5-next v1] net/mlx5: Check device memory pointer before usage

[Leon Romanovsky]

On Tue, 01 Jul 2025 15:08:12 +0300, Leon Romanovsky wrote:
> Add a NULL check before accessing device memory to prevent a crash if
> dev->dm allocation in mlx5_init_once() fails.
> 
> 

Applied, thanks!

[1/1] net/mlx5: Check device memory pointer before usage
      https://git.kernel.org/rdma/rdma/c/70f238c902b8c0

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>

Re: [PATCH mlx5-next v1] net/mlx5: Check device memory pointer before usage

[Simon Horman]

On Wed, Jul 02, 2025 at 08:49:53PM +0300, Leon Romanovsky wrote:
> On Wed, Jul 02, 2025 at 03:07:35PM +0100, Simon Horman wrote:
> > On Wed, Jul 02, 2025 at 11:28:47AM +0300, Leon Romanovsky wrote:
> > > On Tue, Jul 01, 2025 at 08:38:58PM +0100, Simon Horman wrote:
> > > > On Tue, Jul 01, 2025 at 03:08:12PM +0300, Leon Romanovsky wrote:
> > > > > From: Stav Aviram <saviram@nvidia.com>
> > > > > 
> > > > > Add a NULL check before accessing device memory to prevent a crash if
> > > > > dev->dm allocation in mlx5_init_once() fails.
> > > > > 
> > > > > Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core")
> > > > > Signed-off-by: Stav Aviram <saviram@nvidia.com>
> > > > > Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> > > > > ---
> > > > > Changelog:
> > > > > v1:
> > > > >  * Removed extra IS_ERR(dm) check.
> > > > > v0:
> > > > > https://lore.kernel.org/all/e389fa6ef075af1049cd7026b912d736ebe3ad23.1751279408.git.leonro@nvidia.com
> > > > > ---
> > > > >  drivers/infiniband/hw/mlx5/dm.c                  | 2 +-
> > > > >  drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++--
> > > > >  drivers/net/ethernet/mellanox/mlx5/core/main.c   | 2 +-
> > > > >  3 files changed, 4 insertions(+), 4 deletions(-)
> > > > > 
> > > > > diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c
> > > > > index b4c97fb62abf..9ded2b7c1e31 100644
> > > > > --- a/drivers/infiniband/hw/mlx5/dm.c
> > > > > +++ b/drivers/infiniband/hw/mlx5/dm.c
> > > > > @@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx,
> > > > >  	int err;
> > > > >  	u64 address;
> > > > >  
> > > > > -	if (!MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> > > > > +	if (!dm_db || !MLX5_CAP_DEV_MEM(dm_db->dev, memic))
> > > > >  		return ERR_PTR(-EOPNOTSUPP);
> > > > 
> > > > nit: -EOPNOTSUPP doesn't feel like the right error code
> > > >      in the !dm_db case.
> > > 
> > > Why? This error is returned to the user through mlx5_ib_alloc_dm().
> > 
> > Because, as I understand things, such a case would be due to a memory
> > allocation failure, not by the device not supporting a feature.
> > 
> > handle_alloc_dm_memic() already returns ERR_PTR(-ENOMEM) if kzalloc() fails.
> > I'd suggest doing so for the !dm_db case too.
> 
> !dm_db case can be because of missing capabilities and EOPNOTSUPP is a
> way to inform users about it.

Understood. No further objections from my side.

...