Re: [PATCH] net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

[Tariq Toukan <tariqt@nvidia.com>]

On 17/09/2026 14:31, Wentao Liang wrote:
> When the reverse entry is found but its counter is already being
> released, refcount_inc_not_zero() fails and the reference taken by
> mlx5_tc_ct_entry_get() is never dropped before falling through to
> create_counter.  Drop it so the reverse entry is not kept alive forever
> by a shared counter lookup that did not use it.
> 
> Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both directions")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> index 6c87a1c7db09..c1841ce74d9a 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> @@ -1082,6 +1082,9 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
>   
>   	spin_unlock_bh(&ct_priv->ht_lock);
>   
> +	if (rev_entry)
> +		mlx5_tc_ct_entry_put(rev_entry);
> +
>   create_counter:
>   
>   	shared_counter = mlx5_tc_ct_counter_create(ct_priv);

Thanks for your patch.

Reviewed-by: Tariq Toukan <tariqt@nvidia.com>