* [PATCH] net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
@ 2026-09-17 11:31 Wentao Liang
2026-09-20 6:39 ` Tariq Toukan
0 siblings, 1 reply; 2+ messages in thread
From: Wentao Liang @ 2026-09-17 11:31 UTC (permalink / raw)
To: andrew+netdev
Cc: davem, edumazet, kuba, leon, linux-kernel, linux-rdma, mbloch,
netdev, ozsh, pabeni, roid, saeedm, tariqt, Wentao Liang, stable
When the reverse entry is found but its counter is already being
released, refcount_inc_not_zero() fails and the reference taken by
mlx5_tc_ct_entry_get() is never dropped before falling through to
create_counter. Drop it so the reverse entry is not kept alive forever
by a shared counter lookup that did not use it.
Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both directions")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
index 6c87a1c7db09..c1841ce74d9a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
@@ -1082,6 +1082,9 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
spin_unlock_bh(&ct_priv->ht_lock);
+ if (rev_entry)
+ mlx5_tc_ct_entry_put(rev_entry);
+
create_counter:
shared_counter = mlx5_tc_ct_counter_create(ct_priv);
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
2026-09-17 11:31 [PATCH] net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() Wentao Liang
@ 2026-09-20 6:39 ` Tariq Toukan
0 siblings, 0 replies; 2+ messages in thread
From: Tariq Toukan @ 2026-09-20 6:39 UTC (permalink / raw)
To: Wentao Liang, andrew+netdev
Cc: davem, edumazet, kuba, leon, linux-kernel, linux-rdma, mbloch,
netdev, ozsh, pabeni, roid, saeedm, tariqt, stable
On 17/09/2026 14:31, Wentao Liang wrote:
> When the reverse entry is found but its counter is already being
> released, refcount_inc_not_zero() fails and the reference taken by
> mlx5_tc_ct_entry_get() is never dropped before falling through to
> create_counter. Drop it so the reverse entry is not kept alive forever
> by a shared counter lookup that did not use it.
>
> Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both directions")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> index 6c87a1c7db09..c1841ce74d9a 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> @@ -1082,6 +1082,9 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
>
> spin_unlock_bh(&ct_priv->ht_lock);
>
> + if (rev_entry)
> + mlx5_tc_ct_entry_put(rev_entry);
> +
> create_counter:
>
> shared_counter = mlx5_tc_ct_counter_create(ct_priv);
Thanks for your patch.
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-20 6:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-17 11:31 [PATCH] net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() Wentao Liang
2026-09-20 6:39 ` Tariq Toukan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®