[PATCH] net/mlx5: fix panic for non template age rules flush

[PATCH] net/mlx5: fix panic for non template age rules flush

[Maayan Kashani]

When a user creates a non-template rule with both age and counter actions,
both actions share the same counter.
If a flow flush occurs, the rule is destroyed and the counter is released.
However, the age sampling callback may still access the counter after it
has been freed, leading to a panic on assertion in debug mode.

This creates a race condition: one thread samples the age while another
releases the counter used by the age action.
The fix is to recheck whether the counter is still in use
before triggering an assertion, as it may have been released
after the initial check.

Fixes: 04a4de756e14 ("net/mlx5: support flow age action with HWS")
Cc: stable@dpdk.org

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_hws_cnt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_hws_cnt.c b/drivers/net/mlx5/mlx5_hws_cnt.c
index fce7a7e815f..6cb748b1352 100644
--- a/drivers/net/mlx5/mlx5_hws_cnt.c
+++ b/drivers/net/mlx5/mlx5_hws_cnt.c
@@ -172,8 +172,13 @@ mlx5_hws_aging_check(struct mlx5_priv *priv, struct mlx5_hws_cnt_pool *cpool)
 			/*
 			 * AGE parameter with state "FREE" couldn't be pointed
 			 * by any counter since counter is destroyed first.
-			 * Fall-through.
+			 * Since this check is async, we may reach race condition
+			 * where the counter was freed, after the in_used was checked.
+			 * Fall-through in case the counter is still used and age was freed.
 			 */
+			if (!cpool->pool[i].in_used)
+				continue;
+			/* FALLTHROUGH */
 		default:
 			MLX5_ASSERT(0);
 			continue;
-- 
2.21.0