netdev - Re: [net-next,v6,11/13] octeontx2-pf: cn20k: Add TC rules support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260129051311.376689-1-kuba@kernel.org>
Date: Wed, 28 Jan 2026 21:13:11 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: rkannoth@...vell.com
Cc: Jakub Kicinski <kuba@...nel.org>,
	edumazet@...gle.com,
	sumang@...vell.com,
	linux-kernel@...r.kernel.org,
	sbhatta@...vell.com,
	davem@...emloft.net,
	netdev@...r.kernel.org,
	pabeni@...hat.com,
	andrew+netdev@...n.ch,
	sgoutham@...vell.com
Subject: Re: [net-next,v6,11/13] octeontx2-pf: cn20k: Add TC rules support

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
octeontx2-pf: cn20k: Add TC rules support

This patch adds dynamic MCAM entry allocation for TC rules on CN20K
silicon. The AF driver allocates entries on the fly when the user
installs a rule.

> diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
> index 26a08d2cfbb1..866d9451f5d6 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c

[ ... ]

> @@ -1292,7 +1277,23 @@ static int otx2_tc_add_flow(struct otx2_nic *nic,
>  	if (old_node)
>  		otx2_tc_del_flow(nic, tc_flow_cmd);
>
> +	if (is_cn20k(nic->pdev)) {
> +		rc = cn20k_tc_alloc_entry(nic, tc_flow_cmd, new_node, &dummy);
> +		if (rc) {
> +			NL_SET_ERR_MSG_MOD(extack,
> +					   "MCAM rule allocation failed");
> +			kfree_rcu(new_node, rcu);
> +			return rc;
> +		}
> +	}
> +
> +	entry = otx2_tc_update_mcam_table(nic, flow_cfg, new_node, true);
> +	if (entry < 0) {
> +		NL_SET_ERR_MSG_MOD(extack, "Adding rule failed");
> +		rc = entry;
> +		goto free_leaf;
> +	}
> +
>  	mutex_lock(&nic->mbox.lock);
>  	req = otx2_mbox_alloc_msg_npc_install_flow(&nic->mbox);
>  	if (!req) {
>  		mutex_unlock(&nic->mbox.lock);
>  		rc = -ENOMEM;
>  		goto free_leaf;
                ^^^^^^^^^^^^^^

For CN20K, cn20k_tc_alloc_entry() allocates an MCAM entry from the AF
driver and stores it in new_node->entry. If otx2_mbox_alloc_msg_npc_install_flow()
or otx2_sync_mbox_msg() later fails, the code jumps to free_leaf.

Looking at the free_leaf cleanup path below, it calls
otx2_tc_del_from_flow_list() and kfree_rcu() but does not call
cn20k_tc_free_mcam_entry() to release the AF-allocated entry.

Can this leak the MCAM entry on CN20K when these error paths are taken?

The cn20k_tc_update_mcam_table_add_req() function does call
cn20k_tc_free_mcam_entry() when it fails internally (due to X2/X4 mix),
which suggests MCAM entry cleanup is expected on error.

[ ... ]

> @@ -1328,0 +1328,24 @@ free_leaf:
> +free_leaf:
> +	otx2_tc_del_from_flow_list(flow_cfg, new_node);
> +	if (new_node->is_act_police) {

[ ... ]

> +	kfree_rcu(new_node, rcu);
                 ^^^^^^^^

The node is freed here without first calling cn20k_tc_free_mcam_entry()
to return the MCAM entry to the AF driver.

This was previously noted during review:
https://lore.kernel.org/netdev/20260118004028.1044419-1-kuba@kernel.org/