[5.10,120/142] net/mlx5e: Fix CT rule + encap slow path offload and deletion

From: Paul Blakey <paulb@nvidia.com>

From: Paul Blakey <paulb@nvidia.com>

[ Upstream commit 89e394675818bde8e30e135611c506455fa03fb7 ]

Currently, if a neighbour isn't valid when offloading tunnel encap rules,
we offload the original match and replace the original action with
"goto slow path" action. For this we use a temporary flow attribute based
on the original flow attribute and then change the action. Flow flags,
which among those is the CT flag, are still shared for the slow path rule
offload, so we end up parsing this flow as a CT + goto slow path rule.

Besides being unnecessary, CT action offload saves extra information in
the passed flow attribute, such as created ct_flow and mod_hdr, which
is lost onces the temporary flow attribute is freed.

When a neigh is updated and is valid, we offload the original CT rule
with original CT action, which again creates a ct_flow and mod_hdr
and saves it in the flow's original attribute. Then we delete the slow
path rule with a temporary flow attribute based on original updated
flow attribute, and we free the relevant ct_flow and mod_hdr.

Then when tc deletes this flow, we try to free the ct_flow and mod_hdr
on the flow's attribute again.

To fix the issue, skip all furture proccesing (CT/Sample/Split rules)
in offload/unoffload of slow path rules.

Call trace:
[  758.850525] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000218
[  758.952987] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[  758.964170] Modules linked in: act_csum(E) act_pedit(E) act_tunnel_key(E) act_ct(E) nf_flow_table(E) xt_nat(E) ip6table_filter(E) ip6table_nat(E) xt_comment(E) ip6_tables(E) xt_conntrack(E) xt_MASQUERADE(E) nf_conntrack_netlink(E) xt_addrtype(E) iptable_filter(E) iptable_nat(E) bpfilter(E) br_netfilter(E) bridge(E) stp(E) llc(E) xfrm_user(E) overlay(E) act_mirred(E) act_skbedit(E) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) esp6_offload(E) esp6(E) esp4_offload(E) esp4(E) xfrm_algo(E) mlx5_ib(OE) ib_uverbs(OE) geneve(E) ip6_udp_tunnel(E) udp_tunnel(E) nfnetlink_cttimeout(E) nfnetlink(E) mlx5_core(OE) act_gact(E) cls_flower(E) sch_ingress(E) openvswitch(E) nsh(E) nf_conncount(E) nf_nat(E) mlxfw(OE) psample(E) nf_conntrack(E) nf_defrag_ipv4(E) vfio_mdev(E) mdev(E) ib_core(OE) mlx_compat(OE) crct10dif_ce(E) uio_pdrv_genirq(E) uio(E) i2c_mlx(E) mlxbf_pmc(E) sbsa_gwdt(E) mlxbf_gige(E) gpio_mlxbf2(E) mlxbf_pka(E) mlx_trio(E) mlx_bootctl(E) bluefield_edac(E) knem(O)
[  758.964225]  ip_tables(E) mlxbf_tmfifo(E) ipv6(E) crc_ccitt(E) nf_defrag_ipv6(E)
[  759.154186] CPU: 5 PID: 122 Comm: kworker/u16:1 Tainted: G           OE     5.4.60-mlnx.52.gde81e85 #1
[  759.172870] Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS BlueField:3.5.0-2-gc1b5d64 Jan  4 2021
[  759.195466] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]
[  759.207344] pstate: a0000005 (NzCv daif -PAN -UAO)
[  759.217003] pc : mlx5_del_flow_rules+0x5c/0x160 [mlx5_core]
[  759.228229] lr : mlx5_del_flow_rules+0x34/0x160 [mlx5_core]
[  759.405858] Call trace:
[  759.410804]  mlx5_del_flow_rules+0x5c/0x160 [mlx5_core]
[  759.421337]  __mlx5_eswitch_del_rule.isra.43+0x5c/0x1c8 [mlx5_core]
[  759.433963]  mlx5_eswitch_del_offloaded_rule_ct+0x34/0x40 [mlx5_core]
[  759.446942]  mlx5_tc_rule_delete_ct+0x68/0x74 [mlx5_core]
[  759.457821]  mlx5_tc_ct_delete_flow+0x160/0x21c [mlx5_core]
[  759.469051]  mlx5e_tc_unoffload_fdb_rules+0x158/0x168 [mlx5_core]
[  759.481325]  mlx5e_tc_encap_flows_del+0x140/0x26c [mlx5_core]
[  759.492901]  mlx5e_rep_update_flows+0x11c/0x1ec [mlx5_core]
[  759.504127]  mlx5e_rep_neigh_update+0x160/0x200 [mlx5_core]
[  759.515314]  process_one_work+0x178/0x400
[  759.523350]  worker_thread+0x58/0x3e8
[  759.530685]  kthread+0x100/0x12c
[  759.537152]  ret_from_fork+0x10/0x18
[  759.544320] Code: 97ffef55 51000673 3100067f 54ffff41 (b9421ab3)
[  759.556548] ---[ end trace fab818bb1085832d ]---

Fixes: 4c3844d9e97e ("net/mlx5e: CT: Introduce connection tracking")
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 7 +++++++
 1 file changed, 7 insertions(+)

Message ID	20210202133002.661037364@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Paul Blakey <paulb@nvidia.com>, Roi Dayan <roid@nvidia.com>, Vlad Buslov <vladbu@nvidia.com>, Saeed Mahameed <saeedm@nvidia.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 120/142] net/mlx5e: Fix CT rule + encap slow path offload and deletion Date: Tue, 2 Feb 2021 14:38:03 +0100 Message-Id: <20210202133002.661037364@linuxfoundation.org> In-Reply-To: <20210202132957.692094111@linuxfoundation.org> References: <20210202132957.692094111@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk
Series	None \| expand [5.10,002/142] nbd: freeze the queue while were adding connections [5.10,003/142] tty: avoid using vfs_iocb_iter_write() for redirected console writes [5.10,004/142] ACPI: sysfs: Prefer "compatible" modalias [5.10,005/142] ACPI: thermal: Do not call acpi_thermal_check() directly [5.10,006/142] kernel: kexec: remove the lock operation of system_transition_mutex [5.10,007/142] ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 [5.10,008/142] ALSA: hda/via: Apply the workaround generically for Clevo machines [5.10,009/142] parisc: Enable -mlong-calls gcc option by default when !CONFIG_MODULES [5.10,010/142] media: cec: add stm32 driver [5.10,011/142] media: cedrus: Fix H264 decoding [5.10,012/142] media: hantro: Fix reset_raw_fmt initialization [5.10,013/142] media: rc: fix timeout handling after switch to microsecond durations [5.10,014/142] media: rc: ite-cir: fix min_timeout calculation [5.10,015/142] media: rc: ensure that uevent can be read directly after rc device register [5.10,016/142] ARM: dts: tbs2910: rename MMC node aliases [5.10,017/142] ARM: dts: ux500: Reserve memory carveouts [5.10,018/142] ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming [5.10,019/142] wext: fix NULL-ptr-dereference with cfg80211s lack of commit() [5.10,020/142] x86/xen: avoid warning in Xen pv guest with CONFIG_AMD_MEM_ENCRYPT enabled [5.10,021/142] ASoC: AMD Renoir - refine DMI entries for some Lenovo products [5.10,022/142] Revert "drm/amdgpu/swsmu: drop set_fan_speed_percent (v2)" [5.10,023/142] drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors [5.10,024/142] drm/i915: Always flush the active worker before returning from the wait [5.10,025/142] drm/i915/gt: Always try to reserve GGTT address 0x0 [5.10,026/142] drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes [5.10,027/142] bcache: only check feature sets when sb->version >= BCACHE_SB_VERSION_CDEV_WITH_FE... [5.10,028/142] net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family [5.10,029/142] s390: uv: Fix sysfs max number of VCPUs reporting [5.10,030/142] s390/vfio-ap: No need to disable IRQ after queue reset [5.10,031/142] PM: hibernate: flush swap writer after marking [5.10,032/142] x86/entry: Emit a symbol for register restoring thunk [5.10,033/142] efi/apple-properties: Reinstate support for boolean properties [5.10,034/142] crypto: marvel/cesa - Fix tdma descriptor on 64-bit [5.10,035/142] drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs [5.10,036/142] drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] [5.10,037/142] btrfs: fix lockdep warning due to seqcount_mutex on 32bit arch [5.10,038/142] btrfs: fix possible free space tree corruption with online conversion [5.10,039/142] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] [5.10,040/142] KVM: x86/pmu: Fix UBSAN shift-out-of-bounds warning in intel_pmu_refresh() [5.10,041/142] KVM: arm64: Filter out v8.1+ events on v8.0 HW [5.10,042/142] KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit [5.10,043/142] KVM: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode for VMX [5.10,044/142] KVM: nVMX: Sync unsyncd vmcs02 state to vmcs12 on migration [5.10,045/142] KVM: x86: get smi pending status correctly [5.10,046/142] KVM: Forbid the use of tagged userspace addresses for memslots [5.10,047/142] io_uring: fix wqe->lock/completion_lock deadlock [5.10,048/142] xen: Fix XenStore initialisation for XS_LOCAL [5.10,049/142] leds: trigger: fix potential deadlock with libata [5.10,050/142] arm64: dts: broadcom: Fix USB DMA address translation for Stingray [5.10,051/142] mt7601u: fix kernel crash unplugging the device [5.10,052/142] mt76: mt7663s: fix rx buffer refcounting [5.10,053/142] mt7601u: fix rx buffer refcounting [5.10,054/142] iwlwifi: Fix IWL_SUBDEVICE_NO_160 macro to use the correct bit. [5.10,055/142] drm/i915/gt: Clear CACHE_MODE prior to clearing residuals [5.10,056/142] drm/i915/pmu: Dont grab wakeref when enabling events [5.10,057/142] net/mlx5e: Fix IPSEC stats [5.10,058/142] ARM: dts: imx6qdl-kontron-samx6i: fix pwms for lcd-backlight [5.10,059/142] drm/nouveau/svm: fail NOUVEAU_SVM_INIT ioctl on unsupported devices [5.10,060/142] drm/vc4: Correct lbm size and calculation [5.10,061/142] drm/vc4: Correct POS1_SCL for hvs5 [5.10,062/142] drm/nouveau/dispnv50: Restore pushing of all data. [5.10,063/142] drm/i915: Check for all subplatform bits [5.10,064/142] drm/i915/selftest: Fix potential memory leak [5.10,065/142] uapi: fix big endian definition of ipv6_rpl_sr_hdr [5.10,066/142] KVM: Documentation: Fix spec for KVM_CAP_ENABLE_CAP_VM [5.10,067/142] tee: optee: replace might_sleep with cond_resched [5.10,068/142] xen-blkfront: allow discard-* nodes to be optional [5.10,069/142] blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue [5.10,070/142] clk: imx: fix Kconfig warning for i.MX SCU clk [5.10,071/142] clk: mmp2: fix build without CONFIG_PM [5.10,072/142] clk: qcom: gcc-sm250: Use floor ops for sdcc clks [5.10,073/142] ARM: imx: build suspend-imx6.S with arm instruction set [5.10,074/142] ARM: zImage: atags_to_fdt: Fix node names on added root nodes [5.10,075/142] netfilter: nft_dynset: add timeout extension to template [5.10,076/142] Revert "RDMA/mlx5: Fix devlink deadlock on net namespace deletion" [5.10,077/142] Revert "block: simplify set_init_blocksize" to regain lost performance [5.10,078/142] xfrm: Fix oops in xfrm_replay_advance_bmp [5.10,079/142] xfrm: fix disable_xfrm sysctl when used on xfrm interfaces [5.10,080/142] selftests: xfrm: fix test return value override issue in xfrm_policy.sh [5.10,081/142] xfrm: Fix wraparound in xfrm_policy_addr_delta() [5.10,082/142] arm64: dts: ls1028a: fix the offset of the reset register [5.10,083/142] ARM: imx: fix imx8m dependencies [5.10,084/142] ARM: dts: imx6qdl-kontron-samx6i: fix i2c_lcd/cam default status [5.10,085/142] ARM: dts: imx6qdl-sr-som: fix some cubox-i platforms [5.10,086/142] arm64: dts: imx8mp: Correct the gpio ranges of gpio3 [5.10,087/142] firmware: imx: select SOC_BUS to fix firmware build [5.10,088/142] RDMA/cxgb4: Fix the reported max_recv_sge value [5.10,089/142] ASoC: dt-bindings: lpass: Fix and common up lpass dai ids [5.10,090/142] ASoC: qcom: Fix incorrect volatile registers [5.10,091/142] ASoC: qcom: Fix broken support to MI2S TERTIARY and QUATERNARY [5.10,092/142] ASoC: qcom: lpass-ipq806x: fix bitwidth regmap field [5.10,093/142] spi: altera: Fix memory leak on error path [5.10,094/142] ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete [5.10,095/142] powerpc/64s: prevent recursive replay_soft_interrupts causing superfluous interrupt [5.10,096/142] pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() [5.10,097/142] pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn [5.10,098/142] ASoC: SOF: Intel: soundwire: fix select/depend unmet dependencies [5.10,099/142] ASoC: qcom: lpass: Fix out-of-bounds DAI ID lookup [5.10,100/142] iwlwifi: pcie: avoid potential PNVM leaks [5.10,101/142] iwlwifi: pnvm: dont skip everything when not reloading [5.10,102/142] iwlwifi: pnvm: dont try to load after failures [5.10,103/142] iwlwifi: pcie: set LTR on more devices [5.10,104/142] iwlwifi: pcie: use jiffies for memory read spin time limit [5.10,105/142] iwlwifi: pcie: reschedule in long-running memory reads [5.10,106/142] mac80211: pause TX while changing interface type [5.10,107/142] ice: fix FDir IPv6 flexbyte [5.10,108/142] ice: Implement flow for IPv6 next header (extension header) [5.10,109/142] ice: update dev_addr in ice_set_mac_address even if HW filter exists [5.10,110/142] ice: Dont allow more channels than LAN MSI-X available [5.10,111/142] ice: Fix MSI-X vector fallback logic [5.10,112/142] i40e: acquire VSI pointer only after VF is initialized [5.10,113/142] igc: fix link speed advertising [5.10,114/142] net/mlx5: Fix memory leak on flow table creation error flow [5.10,115/142] net/mlx5e: E-switch, Fix rate calculation for overflow [5.10,116/142] net/mlx5e: free page before return [5.10,117/142] net/mlx5e: Reduce tc unsupported key print level [5.10,118/142] net/mlx5: Maintain separate page trees for ECPF and PF functions [5.10,119/142] net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled [5.10,120/142] net/mlx5e: Fix CT rule + encap slow path offload and deletion [5.10,121/142] net/mlx5e: Correctly handle changing the number of queues when the interface is down [5.10,122/142] net/mlx5e: Revert parameters on errors when changing trust state without reset [5.10,123/142] net/mlx5e: Revert parameters on errors when changing MTU and LRO state without reset [5.10,124/142] net/mlx5: CT: Fix incorrect removal of tuple_nat_node from nat rhashtable [5.10,125/142] can: dev: prevent potential information leak in can_fill_info() [5.10,126/142] ACPI/IORT: Do not blindly trust DMA masks from firmware [5.10,127/142] of/device: Update dma_range_map only when dev has valid dma-ranges [5.10,128/142] iommu/amd: Use IVHD EFR for early initialization of IOMMU features [5.10,129/142] iommu/vt-d: Correctly check addr alignment in qi_flush_dev_iotlb_pasid() [5.10,130/142] nvme-multipath: Early exit if no path is available [5.10,131/142] selftests: forwarding: Specify interface when invoking mausezahn [5.10,132/142] rxrpc: Fix memory leak in rxrpc_lookup_local [5.10,133/142] NFC: fix resource leak when target index is invalid [5.10,134/142] NFC: fix possible resource leak [5.10,135/142] ASoC: mediatek: mt8183-da7219: ignore TDM DAI link by default [5.10,136/142] ASoC: mediatek: mt8183-mt6358: ignore TDM DAI link by default [5.10,137/142] ASoC: topology: Properly unregister DAI on removal [5.10,138/142] ASoC: topology: Fix memory corruption in soc_tplg_denum_create_values() [5.10,139/142] scsi: qla2xxx: Fix description for parameter ql2xenforce_iocb_limit [5.10,140/142] team: protect features update by RCU to avoid deadlock [5.10,141/142] tcp: make TCP_USER_TIMEOUT accurate for zero window probes [5.10,142/142] tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN

[5.10,120/142] net/mlx5e: Fix CT rule + encap slow path offload and deletion

Commit Message

Patch