From: Alexandre Cassen <acassen@corp.free.fr>
To: Saeed Mahameed <saeedm@nvidia.com>,
Leon Romanovsky <leon@kernel.org>,
Tariq Toukan <tariqt@nvidia.com>, Mark Bloch <mbloch@nvidia.com>,
sashiko-reviews@lists.linux.dev
Cc: Andrew Lunn <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Moshe Shemesh <moshe@nvidia.com>,
Yevgeny Kliteynik <kliteyn@nvidia.com>,
netdev@vger.kernel.org, linux-rdma@vger.kernel.org
Subject: Re: [PATCH net 2/2] net/mlx5: HWS, fix modify header pool creation race
Date: Sat, 10 Oct 2026 12:35:23 +0200 [thread overview]
Message-ID: <3a18d136-36a5-4edf-a3df-0838d119c38e@corp.free.fr> (raw)
In-Reply-To: <sashiko-outbox-166055@kernel.org>
(replying to Sashiko... strange feeling)
Adding back original recipients. Sashiko review at:
https://sashiko.dev/#/patchset/20261008204230.3222198-1-acassen@corp.free.fr?part=2
On 10/9/26 22:43, sashiko-bot@kernel.org wrote:
> Does mlx5_fs_hws_mh_pool_match() incorrectly truncate 64-bit modify actions to
> 32 bits during comparison?
This code predates the patch. On little-endian the cast keeps the first
half of each action. That half holds the type and field. Dropping the
value in the second half is intended since each rule passes its values
as arguments. mlx5hws_pat_compare_pattern() does the same.
but there is a real bug. Copy and add_field actions keep their
destination in the second half. The core compares them in full but the
pool match does not. Two copies that differ only in destination then
share a pool and the second rule writes to the wrong field. RDMA flow
actions can trigger it from userspace.
I will send a separate fix for this.
-- Alexandre
next prev parent reply other threads:[~2026-10-10 10:35 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-08 20:42 [PATCH net 0/2] net/mlx5: HWS, fix pool creation races Alexandre Cassen
2026-10-08 20:42 ` [PATCH net 1/2] net/mlx5: HWS, fix reformat pool creation race Alexandre Cassen
2026-10-11 7:27 ` Moshe Shemesh
2026-10-08 20:42 ` [PATCH net 2/2] net/mlx5: HWS, fix modify header " Alexandre Cassen
[not found] ` <sashiko-outbox-166055@kernel.org>
2026-10-10 10:35 ` Alexandre Cassen [this message]
2026-10-11 7:57 ` Moshe Shemesh
2026-10-11 17:35 ` Alexandre Cassen
2026-10-08 20:45 ` [PATCH net 0/2] net/mlx5: HWS, fix pool creation races netdev-bot+sinfo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3a18d136-36a5-4edf-a3df-0838d119c38e@corp.free.fr \
--to=acassen@corp.free.fr \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@kernel.org \
--cc=kliteyn@nvidia.com \
--cc=kuba@kernel.org \
--cc=leon@kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=mbloch@nvidia.com \
--cc=moshe@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=saeedm@nvidia.com \
--cc=sashiko-reviews@lists.linux.dev \
--cc=tariqt@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox