Re: [PATCH net] net/mlx5: macsec: Don't remove fs_id when adding a rule fails

[Tariq Toukan <tariqt@nvidia.com>]

On 05/11/2026 2:34, Changyul Lee wrote:
> macsec_fs_tx_add_rule() and macsec_fs_rx_add_rule() clean up a failed
> rule with macsec_fs_{tx,rx}_del_rule(), which also calls
> macsec_fs_id_del(). The fs_id is never in the xarray at that point:
> macsec_fs_id_add() is the last step of adding a rule and removes its
> own entry when it fails.
> 
> macsec_fs_id_del() then dereferences NULL, through macsec_device for
> the first SA of a MACsec netdev and through fs_id_found otherwise. On
> RX, the SAs of one SC share an fs_id, so a failure while adding another
> SA drops the reference that an existing SA holds.
> 
> Split the rule teardown from the fs_id removal and do only the teardown
> on the error paths.
> 
> Fixes: d4ece08f4b1d ("net/mlx5: Maintain fs_id xarray per MACsec device inside macsec steering")
> Signed-off-by: Changyul Lee <lcy8047@gmail.com>
> ---
> Found with a static analysis tool we are developing.
> 
> Compile-tested only (x86_64, W=1, CONFIG_MLX5_MACSEC=y). I do not have
> MACsec-capable ConnectX hardware and QEMU does not emulate it, so the
> failure was not reproduced.
> 
>   .../mellanox/mlx5/core/lib/macsec_fs.c        | 38 ++++++++++++-------
>   1 file changed, 24 insertions(+), 14 deletions(-)
> 
Thanks for your patch.

Reviewed-by: Tariq Toukan <tariqt@nvidia.com>