[PATCH] net/mlx5e: TC, release meter if rule offload fails

[PATCH] net/mlx5e: TC, release meter if rule offload fails

[Wentao Liang]

mlx5e_tc_rule_offload() adds the flow meter to the attribute and then
adds the offloaded rule. If mlx5_eswitch_add_offloaded_rule() fails, the
meter reference taken by mlx5e_tc_add_flow_meter() is not dropped.

The error propagates to mlx5e_tc_add_fdb_flow() and the flow is freed
without the OFFLOADED flag, so mlx5e_tc_rule_unoffload() and
mlx5e_tc_del_flow_meter() are never called. Release the meter and the
post meter state in the failure path of mlx5e_tc_rule_offload() itself.

Fixes: a8d52b024d6d ("net/mlx5e: TC, Support offloading police action")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 708b7987ea4c..17bd92529a44 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -491,6 +491,8 @@ mlx5e_tc_rule_offload(struct mlx5e_priv *priv,
 		      struct mlx5_flow_attr *attr)
 {
 	struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+	struct mlx5_flow_handle *rule;
+	bool meter_added = false;
 	int err;
 
 	if (!is_mdev_switchdev_mode(priv->mdev))
@@ -503,9 +505,14 @@ mlx5e_tc_rule_offload(struct mlx5e_priv *priv,
 		err = mlx5e_tc_add_flow_meter(priv, attr);
 		if (err)
 			return ERR_PTR(err);
+		meter_added = true;
 	}
 
-	return mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
+	rule = mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
+	if (IS_ERR(rule) && meter_added)
+		mlx5e_tc_del_flow_meter(esw, attr);
+
+	return rule;
 }
 
 void
-- 
2.34.1

Re: [PATCH] net/mlx5e: TC, release meter if rule offload fails

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] net/mlx5e: TC, release meter if rule offload fails

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The new failure path in mlx5e_tc_rule_offload()
  (drivers/net/ethernet/mellanox/mlx5/core/en_tc.c) calls…

--

net/mlx5e: TC, release meter if rule offload fails

When mlx5_eswitch_add_offloaded_rule() fails, this patch makes
mlx5e_tc_rule_offload() release the flow meter and the post meter state
that mlx5e_tc_add_flow_meter() set up. Before the patch, that meter
reference leaked when mlx5e_tc_add_fdb_flow() failed.

> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 708b7987ea4cd..17bd92529a44a 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c

[ ... ]

> @@ -503,9 +505,14 @@ mlx5e_tc_rule_offload(struct mlx5e_priv *priv,
>  		err = mlx5e_tc_add_flow_meter(priv, attr);
>  		if (err)
>  			return ERR_PTR(err);
> +		meter_added = true;
>  	}
>  
> -	return mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
> +	rule = mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
> +	if (IS_ERR(rule) && meter_added)
> +		mlx5e_tc_del_flow_meter(esw, attr);

[Severity: Medium]
Can this lead to a double free of the post meter and an extra meter put?

mlx5e_tc_del_flow_meter() kfree()s attr->meter_attr.post_meter and drops
the attr->meter_attr.meter reference, but it does not clear either
pointer:

mlx5e_tc_del_flow_meter() {
	mlx5e_post_meter_cleanup(esw, attr->meter_attr.post_meter);
	mlx5e_tc_meter_put(attr->meter_attr.meter);
}

attr->dest_ft and the FWD_DEST action bit set by
mlx5e_tc_add_flow_meter() also stay in place.

mlx5e_tc_rule_unoffload() treats a non-NULL meter pointer as a live
reference:

	if (attr->meter_attr.meter)
		mlx5e_tc_del_flow_meter(esw, attr);

So any later unoffload of the same attr releases the meter again.

That later unoffload looks reachable through mlx5e_reoffload_encap() in
en/tc_tun_encap.c. Consider a fast path FDB flow with a police or MTU
meter that redirects to an encap device:

mlx5e_invalidate_encap()
  mlx5e_tc_unoffload_fdb_rules(esw, flow, flow->attr)
    releases meter ref #1 and post_meter P1

mlx5e_reoffload_encap()
  mlx5e_tc_offload_fdb_rules()
    mlx5e_tc_rule_offload()
      mlx5e_tc_add_flow_meter()          takes ref #2 and P2
      mlx5_eswitch_add_offloaded_rule()  fails
      mlx5e_tc_del_flow_meter()          frees P2, puts ref #2,
                                         attr->meter_attr still set

mlx5e_reoffload_encap() then marks the flow as offloaded even when this
step fails:

		rule = mlx5e_tc_offload_fdb_rules(esw, flow, spec, flow->attr);
		if (IS_ERR(rule)) {
			mlx5e_tc_unoffload_flow_post_acts(flow);
			...
		}
		...
		flow_flag_set(flow, OFFLOADED);

The flow is now OFFLOADED and not SLOW. The next flow delete
(mlx5e_tc_del_fdb_flow()) or route event (mlx5e_invalidate_encap()) goes
through:

mlx5e_tc_unoffload_fdb_rules()
  mlx5e_tc_rule_unoffload()
    mlx5e_tc_del_flow_meter()
      mlx5e_post_meter_cleanup()  reads freed P2->type, destroys its HW
                                  objects again, kfree()s P2 again
      mlx5e_tc_meter_put()        drops a reference that is no longer
                                  held

The extra mlx5e_tc_meter_put() could also destroy a meter that other
flows using the same police index still rely on.

Before this patch, P2 and ref #2 leaked at the failure point and were
released exactly once by the later unoffload. With this patch they are
released twice.

The same mlx5e_tc_rule_unoffload() call also passes the stale
flow->rule[0] to mlx5_eswitch_del_offloaded_rule() on this path. That
problem already existed and comes from the unconditional OFFLOADED in
mlx5e_reoffload_encap(). The split_count failure branch in
mlx5e_tc_offload_fdb_rules() already left similar stale meter state
before this patch. The main path this commit targets, where
mlx5e_tc_add_fdb_flow() fails, does look correct.

Would it help to set attr->meter_attr.meter and
attr->meter_attr.post_meter to NULL, and undo the attr->dest_ft change,
after mlx5e_tc_del_flow_meter() in this failure path? A later unoffload
would then skip the meter release.

> +
> +	return rule;
>  }

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261103102856.1340672-1-vulab%40iscas.ac.cn