net/mlx5e: psp: Fix invalid access on PSP dev registration fail

priv->psp->psp is initialized with the PSP device as returned by
psp_dev_create(). This could also return an error, in which case a
future psp_dev_unregister() will result in unpleasantness.

Avoid that by using a local variable and only saving the PSP device when
registration succeeds.

In case psp_dev_create() fails, priv->psp and steering structs are left
in place, but they will be inert. The unchecked access of priv->psp in
mlx5e_psp_offload_handle_rx_skb() won't happen because without a PSP
device, there can be no SAs added and therefore no packets will be
successfully decrypted and be handed off to the SW handler.

Fixes: 89ee2d92f66c ("net/mlx5e: Support PSP offload functionality")
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260504181100.269334-2-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c
index 6a50b6dec0fa828a71df4cd1e70ea4485d992978..1ff818fb48df2cf3a223c344e0aac7e5b194d71c 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c
@@ -1070,29 +1070,37 @@ static struct psp_dev_ops mlx5_psp_ops = {
 
 void mlx5e_psp_unregister(struct mlx5e_priv *priv)
 {
-       if (!priv->psp || !priv->psp->psp)
+       struct mlx5e_psp *psp = priv->psp;
+
+       if (!psp || !psp->psp)
                return;
 
-       psp_dev_unregister(priv->psp->psp);
+       psp_dev_unregister(psp->psp);
+       psp->psp = NULL;
 }
 
 void mlx5e_psp_register(struct mlx5e_priv *priv)
 {
+       struct mlx5e_psp *psp = priv->psp;
+       struct psp_dev *psd;
+
        /* FW Caps missing */
        if (!priv->psp)
                return;
 
-       priv->psp->caps.assoc_drv_spc = sizeof(u32);
-       priv->psp->caps.versions = 1 << PSP_VERSION_HDR0_AES_GCM_128;
+       psp->caps.assoc_drv_spc = sizeof(u32);
+       psp->caps.versions = 1 << PSP_VERSION_HDR0_AES_GCM_128;
        if (MLX5_CAP_PSP(priv->mdev, psp_crypto_esp_aes_gcm_256_encrypt) &&
            MLX5_CAP_PSP(priv->mdev, psp_crypto_esp_aes_gcm_256_decrypt))
-               priv->psp->caps.versions |= 1 << PSP_VERSION_HDR0_AES_GCM_256;
+               psp->caps.versions |= 1 << PSP_VERSION_HDR0_AES_GCM_256;
 
-       priv->psp->psp = psp_dev_create(priv->netdev, &mlx5_psp_ops,
-                                       &priv->psp->caps, NULL);
-       if (IS_ERR(priv->psp->psp))
+       psd = psp_dev_create(priv->netdev, &mlx5_psp_ops, &psp->caps, NULL);
+       if (IS_ERR(psd)) {
                mlx5_core_err(priv->mdev, "PSP failed to register due to %pe\n",
-                             priv->psp->psp);
+                             psd);
+               return;
+       }
+       psp->psp = psd;
 }
 
 int mlx5e_psp_init(struct mlx5e_priv *priv)