Re: [PATCH] net/mlx5e: TC, fix internal port leak when a flow is reoffloaded

[Tariq Toukan <tariqt@nvidia.com>]

On 03/11/2026 12:28, Wentao Liang wrote:
> For a flow originating from an OVS internal port,
> mlx5e_tc_add_fdb_flow() takes a reference on the internal port and stores
> it in the flow's esw attribute.
> 
> If the flow cannot be offloaded because the encap route is not available
> (-ENETUNREACH) on a multipath LAG setup, __mlx5e_add_fdb_flow() keeps the
> flow on the unready list instead of freeing it. When
> mlx5e_tc_reoffload_flows_work() retries, mlx5e_tc_add_fdb_flow() takes
> another reference and overwrites the stored pointer, so the previous
> reference is never dropped.
> 
> Only look up the internal port if the flow does not hold a reference
> already; the reference is released together with the flow attributes.
> 
> Fixes: 166f431ec6be ("net/mlx5e: Add indirect tc offload of ovs internal port")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   .../net/ethernet/mellanox/mlx5/core/en_tc.c   | 22 ++++++++++---------
>   1 file changed, 12 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 17bd92529a44..8246378b089f 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> @@ -2005,17 +2005,19 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
>   			goto err_out;
>   		}
>   
> -		int_port = mlx5e_tc_int_port_get(mlx5e_get_int_port_priv(priv),
> -						 parse_attr->filter_dev->ifindex,
> -						 flow_flag_test(flow, EGRESS) ?
> -						 MLX5E_TC_INT_PORT_EGRESS :
> -						 MLX5E_TC_INT_PORT_INGRESS);
> -		if (IS_ERR(int_port)) {
> -			err = PTR_ERR(int_port);
> -			goto err_out;
> -		}
> +		if (!esw_attr->int_port) {
> +			int_port = mlx5e_tc_int_port_get(mlx5e_get_int_port_priv(priv),
> +							 parse_attr->filter_dev->ifindex,
> +							 flow_flag_test(flow, EGRESS) ?
> +							 MLX5E_TC_INT_PORT_EGRESS :
> +							 MLX5E_TC_INT_PORT_INGRESS);
> +			if (IS_ERR(int_port)) {
> +				err = PTR_ERR(int_port);
> +				goto err_out;
> +			}

Avoid re-indenting the lookup and pushing it over 80 columns, the check 
can go into the outer condition:

           if (netif_is_ovs_master(parse_attr->filter_dev) &&
               !esw_attr->int_port) {

Please also answer the NetDev bot's questions on how this was found and 
tested.

>   
> -		esw_attr->int_port = int_port;
> +			esw_attr->int_port = int_port;
> +		}
>   	}
>   
>   	err = post_process_attr(flow, attr, extack);