NVIDIA/Mellanox ConnectX flow steering core (mlx5 fs_core FTE active-flag race): Two-phase flow-table-entry deletion

Impact

Two-phase flow-table-entry deletion checks the entry's active flag without holding its lock, so adding a rule with the same match value concurrently with a delete makes fs_core clear the hardware deletion function early and panic on the next removal. The race is between adding and removing rules that match the same traffic - which is what happens when two tenants' network policies touch overlapping match criteria on a shared adapter, so this is reachable by ordinary concurrent activity, not just by a deliberate attacker.

Who can reach it

Local. Concurrent rule add and delete for the same match value on a shared mlx5 adapter, driven by CNI/network-policy churn.

What to do

Kernel update checking the FTE active flag under its lock. No workaround.

References