Kernel panic occurs when reading the /sys/class/net/<mlx5-iface>/settings/hfunc file

Products

• VMware NSX

Issue/Introduction

A kernel panic caused by a NULL pointer dereference is observed in the /var/log/core/<DATE_TIME>/dmesg.<DATE_TIME> file on an NSX Edge node.

The crash occurs within the mlx5e_show_hfunc function, which is specific to NSX Edge nodes equipped with a Mellanox NIC.

[########.######] BUG: kernel NULL pointer dereference, address: ################ [########.######] #PF: supervisor read access in kernel mode [########.######] #PF: error_code(0x####) - not-present page [########.######] PGD cpu_pgd+0x#####/0x###### [lowmem vmlinux] ################                   P4D cpu_pgd+0x#####/0x###### [lowmem vmlinux] ################ [########.######] Oops: #### [##] PREEMPT SMP [########.######] CPU: ## PID: ###### Comm: #### Kdump: loaded Tainted: G     U     OE     5.15.185-nn1-server #nn1 ####################################### [########.######] Hardware name: Lenovo ThinkSystem ##### -[##########]-/-[##########]-, BIOS -[#######-#.##]- ##/##/#### [########.######] RIP: ####:[<################>] mlx5e_show_hfunc+0x##/0x## [mlx5_core]

Environment

VMware NSX 4.2.3

Cause

The panic is triggered when a process opens and reads a sysfs attribute file exposed by an mlx5 uplink NIC. While handling this read request, the driver dereferences a NULL pointer.

Resolution

Workaround:

To prevent this issue, avoid reading the /sys/class/net/<mlx5-iface>/settings/hfunc file using commands such as cat or grep.

This issue will be addressed in a future release.