patch 'net/hns3: fix memory leak for indirect flow action' has been queued to stable release 22.11.9

[luca.boccassi@gmail.com]

Hi,

FYI, your patch has been queued to stable release 22.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 06/14/25. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/399fda81668431073978e0d58f98ea4e36996648

Thanks.

Luca Boccassi

---
From 399fda81668431073978e0d58f98ea4e36996648 Mon Sep 17 00:00:00 2001
From: Dengdui Huang <huangdengdui@huawei.com>
Date: Tue, 8 Apr 2025 16:30:57 +0800
Subject: [PATCH] net/hns3: fix memory leak for indirect flow action

[ upstream commit 18596f7be8f93e159e98704af12b1cc8af289dd6 ]

Currently, when the application creates an indirect action,
the hns3 driver allocates a memory for the structure
rte_flow_action_handle and returns this structure pointer to
application. When the application invokes the destroy function
to destroy the indirect action, the driver releases the memory.

However, when the application destroys all flows by using the
flush function before destroying the indirect action, the memory
is not released. This patch fix it by using uint64_t instead of
rte_flow_action_handle* to store indirect action avoids memory
leakage.

Fixes: fdfcb94d8fb3 ("net/hns3: support indirect counter flow action")

Signed-off-by: Dengdui Huang <huangdengdui@huawei.com>
---
 drivers/net/hns3/hns3_flow.c | 41 ++++++++++++++++--------------------
 drivers/net/hns3/hns3_flow.h |  9 ++++++--
 2 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/drivers/net/hns3/hns3_flow.c b/drivers/net/hns3/hns3_flow.c
index 9fbdf1dbe9..e1180e4fec 100644
--- a/drivers/net/hns3/hns3_flow.c
+++ b/drivers/net/hns3/hns3_flow.c
@@ -470,19 +470,20 @@ hns3_handle_action_indirect(struct rte_eth_dev *dev,
 			    struct hns3_fdir_rule *rule,
 			    struct rte_flow_error *error)
 {
-	const struct rte_flow_action_handle *indir = action->conf;
+	struct rte_flow_action_handle indir;
 
-	if (indir->indirect_type != HNS3_INDIRECT_ACTION_TYPE_COUNT)
+	indir.val64 = (uint64_t)action->conf;
+	if (indir.indirect_type != HNS3_INDIRECT_ACTION_TYPE_COUNT)
 		return rte_flow_error_set(error, EINVAL,
 				RTE_FLOW_ERROR_TYPE_ACTION_CONF,
 				action, "Invalid indirect type");
 
-	if (hns3_counter_lookup(dev, indir->counter_id) == NULL)
+	if (hns3_counter_lookup(dev, indir.counter_id) == NULL)
 		return rte_flow_error_set(error, EINVAL,
 				RTE_FLOW_ERROR_TYPE_ACTION_CONF,
 				action, "Counter id not exist");
 
-	rule->act_cnt.id = indir->counter_id;
+	rule->act_cnt.id = indir.counter_id;
 	rule->flags |= (HNS3_RULE_FLAG_COUNTER | HNS3_RULE_FLAG_COUNTER_INDIR);
 
 	return 0;
@@ -2548,20 +2549,12 @@ hns3_flow_action_create(struct rte_eth_dev *dev,
 	struct hns3_hw *hw = HNS3_DEV_PRIVATE_TO_HW(dev->data->dev_private);
 	struct hns3_pf *pf = HNS3_DEV_PRIVATE_TO_PF(dev->data->dev_private);
 	const struct rte_flow_action_count *act_count;
-	struct rte_flow_action_handle *handle = NULL;
+	struct rte_flow_action_handle handle;
 	struct hns3_flow_counter *counter;
 
 	if (hns3_check_indir_action(conf, action, error))
 		return NULL;
 
-	handle = rte_zmalloc("hns3 action handle",
-			     sizeof(struct rte_flow_action_handle), 0);
-	if (handle == NULL) {
-		rte_flow_error_set(error, ENOMEM, RTE_FLOW_ERROR_TYPE_HANDLE,
-				   NULL, "Failed to allocate action memory");
-		return NULL;
-	}
-
 	pthread_mutex_lock(&hw->flows_lock);
 
 	act_count = (const struct rte_flow_action_count *)action->conf;
@@ -2584,15 +2577,14 @@ hns3_flow_action_create(struct rte_eth_dev *dev,
 	}
 
 	counter->indirect = true;
-	handle->indirect_type = HNS3_INDIRECT_ACTION_TYPE_COUNT;
-	handle->counter_id = counter->id;
+	handle.indirect_type = HNS3_INDIRECT_ACTION_TYPE_COUNT;
+	handle.counter_id = counter->id;
 
 	pthread_mutex_unlock(&hw->flows_lock);
-	return handle;
+	return (struct rte_flow_action_handle *)handle.val64;
 
 err_exit:
 	pthread_mutex_unlock(&hw->flows_lock);
-	rte_free(handle);
 	return NULL;
 }
 
@@ -2602,18 +2594,20 @@ hns3_flow_action_destroy(struct rte_eth_dev *dev,
 			 struct rte_flow_error *error)
 {
 	struct hns3_hw *hw = HNS3_DEV_PRIVATE_TO_HW(dev->data->dev_private);
+	struct rte_flow_action_handle indir;
 	struct hns3_flow_counter *counter;
 
 	pthread_mutex_lock(&hw->flows_lock);
 
-	if (handle->indirect_type != HNS3_INDIRECT_ACTION_TYPE_COUNT) {
+	indir.val64 = (uint64_t)handle;
+	if (indir.indirect_type != HNS3_INDIRECT_ACTION_TYPE_COUNT) {
 		pthread_mutex_unlock(&hw->flows_lock);
 		return rte_flow_error_set(error, EINVAL,
 					RTE_FLOW_ERROR_TYPE_ACTION_CONF,
 					handle, "Invalid indirect type");
 	}
 
-	counter = hns3_counter_lookup(dev, handle->counter_id);
+	counter = hns3_counter_lookup(dev, indir.counter_id);
 	if (counter == NULL) {
 		pthread_mutex_unlock(&hw->flows_lock);
 		return rte_flow_error_set(error, EINVAL,
@@ -2628,8 +2622,7 @@ hns3_flow_action_destroy(struct rte_eth_dev *dev,
 				handle, "Counter id in use");
 	}
 
-	(void)hns3_counter_release(dev, handle->counter_id);
-	rte_free(handle);
+	(void)hns3_counter_release(dev, indir.counter_id);
 
 	pthread_mutex_unlock(&hw->flows_lock);
 	return 0;
@@ -2642,12 +2635,14 @@ hns3_flow_action_query(struct rte_eth_dev *dev,
 		 struct rte_flow_error *error)
 {
 	struct hns3_hw *hw = HNS3_DEV_PRIVATE_TO_HW(dev->data->dev_private);
+	struct rte_flow_action_handle indir;
 	struct rte_flow flow;
 	int ret;
 
 	pthread_mutex_lock(&hw->flows_lock);
 
-	if (handle->indirect_type != HNS3_INDIRECT_ACTION_TYPE_COUNT) {
+	indir.val64 = (uint64_t)handle;
+	if (indir.indirect_type != HNS3_INDIRECT_ACTION_TYPE_COUNT) {
 		pthread_mutex_unlock(&hw->flows_lock);
 		return rte_flow_error_set(error, EINVAL,
 					RTE_FLOW_ERROR_TYPE_ACTION_CONF,
@@ -2655,7 +2650,7 @@ hns3_flow_action_query(struct rte_eth_dev *dev,
 	}
 
 	memset(&flow, 0, sizeof(flow));
-	flow.counter_id = handle->counter_id;
+	flow.counter_id = indir.counter_id;
 	ret = hns3_counter_query(dev, &flow,
 				 (struct rte_flow_query_count *)data, error);
 	pthread_mutex_unlock(&hw->flows_lock);
diff --git a/drivers/net/hns3/hns3_flow.h b/drivers/net/hns3/hns3_flow.h
index 1b49673f11..612890391d 100644
--- a/drivers/net/hns3/hns3_flow.h
+++ b/drivers/net/hns3/hns3_flow.h
@@ -50,8 +50,13 @@ enum {
 };
 
 struct rte_flow_action_handle {
-	int indirect_type;
-	uint32_t counter_id;
+	union {
+		uint64_t val64;
+		struct {
+			int indirect_type;
+			uint32_t counter_id;
+		};
+	};
 };
 
 union hns3_filter_conf {
-- 
2.47.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2025-06-12 22:06:25.012167212 +0100
+++ 0030-net-hns3-fix-memory-leak-for-indirect-flow-action.patch	2025-06-12 22:06:23.850044215 +0100
@@ -1 +1 @@
-From 18596f7be8f93e159e98704af12b1cc8af289dd6 Mon Sep 17 00:00:00 2001
+From 399fda81668431073978e0d58f98ea4e36996648 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 18596f7be8f93e159e98704af12b1cc8af289dd6 ]
+
@@ -19 +20,0 @@
-Cc: stable@dpdk.org
@@ -28 +29 @@
-index 266934b45b..c0238d2bfa 100644
+index 9fbdf1dbe9..e1180e4fec 100644
@@ -31 +32 @@
-@@ -473,19 +473,20 @@ hns3_handle_action_indirect(struct rte_eth_dev *dev,
+@@ -470,19 +470,20 @@ hns3_handle_action_indirect(struct rte_eth_dev *dev,
@@ -56 +57 @@
-@@ -2726,20 +2727,12 @@ hns3_flow_action_create(struct rte_eth_dev *dev,
+@@ -2548,20 +2549,12 @@ hns3_flow_action_create(struct rte_eth_dev *dev,
@@ -78 +79 @@
-@@ -2762,15 +2755,14 @@ hns3_flow_action_create(struct rte_eth_dev *dev,
+@@ -2584,15 +2577,14 @@ hns3_flow_action_create(struct rte_eth_dev *dev,
@@ -97 +98 @@
-@@ -2780,18 +2772,20 @@ hns3_flow_action_destroy(struct rte_eth_dev *dev,
+@@ -2602,18 +2594,20 @@ hns3_flow_action_destroy(struct rte_eth_dev *dev,
@@ -120 +121 @@
-@@ -2806,8 +2800,7 @@ hns3_flow_action_destroy(struct rte_eth_dev *dev,
+@@ -2628,8 +2622,7 @@ hns3_flow_action_destroy(struct rte_eth_dev *dev,
@@ -130 +131 @@
-@@ -2820,12 +2813,14 @@ hns3_flow_action_query(struct rte_eth_dev *dev,
+@@ -2642,12 +2635,14 @@ hns3_flow_action_query(struct rte_eth_dev *dev,
@@ -146 +147 @@
-@@ -2833,7 +2828,7 @@ hns3_flow_action_query(struct rte_eth_dev *dev,
+@@ -2655,7 +2650,7 @@ hns3_flow_action_query(struct rte_eth_dev *dev,