joseogando, thanks for the analysis! It does look like it crashes in the same function but the caller is different (i.e. not tcf_exts_miss_cookie_base_alloc but tc_new_tfilter).
May 02 07:19:29 <redacted>-bf3-a kernel: Call trace: May 02 07:19:29 <redacted>-bf3-a kernel: tcf_action_init+0x200/0x340 May 02 07:19:29 <redacted>-bf3-a kernel: tcf_exts_validate+0x16c/0x184 May 02 07:19:29 <redacted>-bf3-a kernel: fl_set_parms+0x6c/0x5f0 [cls_flower] May 02 07:19:29 <redacted>-bf3-a kernel: fl_change+0x3a0/0xc2c [cls_flower] May 02 07:19:29 <redacted>-bf3-a kernel: tc_new_tfilter+0x2f4/0x8bc https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-bluefield/+git/jammy/tree/net/sched/cls_api.c?h=Ubuntu-bluefield-5.15.0-1050.52#n2277 err = tp->ops->change(net, skb, tp, cl, t->tcm_handle, tca, &fh, flags, extack); https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-bluefield/+git/jammy/tree/net/sched/cls_flower.c?h=Ubuntu-bluefield-5.15.0-1050.52#n2100 fl_change err = fl_set_parms(net, tp, fnew, mask, base, tb, tca[TCA_RATE], tp->chain->tmplt_priv, flags, extack); https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-bluefield/+git/jammy/tree/net/sched/cls_flower.c?h=Ubuntu-bluefield-5.15.0-1050.52#n1957 fl_set_parms err = tcf_exts_validate(net, tp, tb, est, &f->exts, flags, extack); https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-bluefield/+git/jammy/tree/net/sched/cls_api.c?h=Ubuntu-bluefield-5.15.0-1050.52#n3262 tcf_exts_validate err = tcf_action_init(net, tp, tb[exts->action], rate_tlv, exts->actions, init_res, &attr_size, flags, extack); https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-bluefield/+git/jammy/tree/net/sched/act_api.c?h=Ubuntu-bluefield-5.15.0-1050.52#n1079 tcf_action_init So I think you are right. It looked similar but it's not the same. -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-bluefield in Ubuntu. https://bugs.launchpad.net/bugs/2109993 Title: linux-bluefield is vulnerable to CVE-2025-21857 Status in linux-bluefield package in Ubuntu: Confirmed Bug description: Currently linux-bluefield is vulnerable to https://ubuntu.com/security/CVE-2025-21857. I encountered instances of this on several hundred BF3 cards that crashed over time with a null pointer dereference causing outages. The latest Bluefield image builds are affected https://github.com/Mellanox/bfb-build/blob/9e80eb358e7bb9e62328039745cc43d69eefc64a/ubuntu/22.04/Dockerfile#L33-L46 (bf-bundle-2.10.0-147_25.01_ubuntu-22.04) The unpatched function in linux-bluefield: https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-bluefield/+git/jammy/tree/net/sched/cls_api.c?h=master-next#n99 static int tcf_exts_miss_cookie_base_alloc(struct tcf_exts *exts, struct tcf_proto *tp, u32 handle) { // ... if (err) goto err_xa_alloc; The upstream one-liner: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3c74b5787caf59bb1e9c5fe0a360643a71eb1e8a diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 8e47e5355be613..4f648af8cfaafe 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -97,7 +97,7 @@ tcf_exts_miss_cookie_base_alloc(struct tcf_exts *exts, struct tcf_proto *tp, err = xa_alloc_cyclic(&tcf_exts_miss_cookies_xa, &n->miss_cookie_base, n, xa_limit_32b, &next, GFP_KERNEL); - if (err) + if (err < 0) goto err_xa_alloc; To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-bluefield/+bug/2109993/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
