netdev - Re: [PATCH net-next] net/mlx5e: Mask wqe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1dc533ea-25ad-4c41-a7ff-14dfcfd3a261@linux.dev>
Date: Wed, 14 Jan 2026 16:53:20 +0800
From: Leon Hwang <leon.hwang@...ux.dev>
To: Tariq Toukan <ttoukan.linux@...il.com>, netdev@...r.kernel.org
Cc: Saeed Mahameed <saeedm@...dia.com>, Tariq Toukan <tariqt@...dia.com>,
 Mark Bloch <mbloch@...dia.com>, Leon Romanovsky <leon@...nel.org>,
 Andrew Lunn <andrew+netdev@...n.ch>, "David S . Miller"
 <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 Oz Shlomo <ozsh@...lanox.com>, Paul Blakey <paulb@...lanox.com>,
 Khalid Manaa <khalidm@...dia.com>, Achiad Shochat <achiad@...lanox.com>,
 Jiayuan Chen <jiayuan.chen@...ux.dev>, linux-rdma@...r.kernel.org,
 linux-kernel@...r.kernel.org, Leon Huang Fu <leon.huangfu@...pee.com>
Subject: Re: [PATCH net-next] net/mlx5e: Mask wqe_id when handling rx cqe

On 14/1/26 16:23, Tariq Toukan wrote:
> 
> 
> On 12/01/2026 10:03, Leon Hwang wrote:
>> The wqe_id from CQE contains wrap counter bits in addition to the WQE
>> index. Mask it with sz_m1 to prevent out-of-bounds access to the
>> rq->mpwqe.info[] array when wrap counter causes wqe_id to exceed RQ size.
>>
>> Without this fix, the driver crashes with NULL pointer dereference:
>>
>>    BUG: kernel NULL pointer dereference, address: 0000000000000020
>>    RIP: 0010:mlx5e_skb_from_cqe_mpwrq_linear+0xb3/0x280 [mlx5_core]
>>    Call Trace:
>>     <IRQ>
>>     mlx5e_handle_rx_cqe_mpwrq+0xe3/0x290 [mlx5_core]
>>     mlx5e_poll_rx_cq+0x97/0x820 [mlx5_core]
>>     mlx5e_napi_poll+0x110/0x820 [mlx5_core]
>>
> 
> Hi,
> 
> We do not expect out-of-bounds index, fixing it this way is not
> necessarily correct.
> 
> Can you please elaborate on your test case, setup, and how to repro?

Hi,

Thanks for the feedback.

Unfortunately, we cannot reliably reproduce this issue on demand, as it
was triggered on a production server. However, we preserved both the
dmesg output and the coredump.

>From analysis of the coredump, the wqe_id value was *4167*, which is
unexpectedly out of bounds for the RQ size and led to the NULL pointer
dereference shown above.

For reference, here is the environment where the issue was observed:

NIC:      Mellanox Technologies MT2892 Family [ConnectX-6 Dx]
Firmware: 22.43.2566 (MT_0000000359)
OFED:     MLNX_OFED 24.10-2.1.8
Kernel:   5.15.0-189.012-shopee (Ubuntu 24.04 based)

Queue configuration:
# ethtool -g enp23s0f0np0
RX: 4096
TX: 4096
# ethtool -l enp23s0f0np0
Combined: 20

Please let me know if additional details would be helpful.

Thanks,
Leon

[...]