Re: [PATCH net] net/mlx5: fs, fix invalid pointer dereference in mlx5_fs_add_rule tracepoint

[Moshe Shemesh]

On 3/28/2026 10:20 PM, kenneth@xxxxxxxxxxxxx wrote:
> The mlx5_fs_add_rule tracepoint has used the flow destination type in
> a bitwise test since its introduction. However, that's not a valid way
> to treat it anymore (if it ever was), and after commit d639af621600dc
> ("net/mlx5: fs, split software and IFC flow destination definitions"),
> this mismatch caused nearly any destination type to be mistaken as a
> flow counter, and thus stashing 32 bits of the mlx5_flow_destination
> union into the counter_id field of the tracepoint.
>
> Later commit 95f68e06b41b9e ("net/mlx5: fs, add counter object to flow
> destination") exacerbates this issue by converting the counter union
> member from an integer to a pointer. Now the tracepoint dereferences
> whichever value is in the union, and in cases where that's not a valid
> pointer, it can lead to a kernel oops.
>
> Fix the check. Reported by GitHub user whi71800.
>
> Cc:stable@xxxxxxxxxxxxxxx
> Fixes: 95f68e06b41b9e ("net/mlx5: fs, add counter object to flow destination")
> Closes:https://github.com/knneth/mlnx-ofa_kernel/issues/1
> Signed-off-by: Kenneth Klette Jonassen<kenneth@xxxxxxxxxxxxx>

Reviewed-by: Moshe Shemesh <moshe@xxxxxxxxxx>

Thanks.