[PATCH] net/mlx5: fix panic for non template age rules flush

[PATCH] net/mlx5: fix panic for non template age rules flush

[Maayan Kashani]

When a user creates a non-template rule with both age and counter actions,
both actions share the same counter.
If a flow flush occurs, the rule is destroyed and the counter is released.
However, the age sampling callback may still access the age/counter during
the free, leading to a panic on assertion in debug mode.

This creates a race condition: one thread samples the age while another
releases the age/counter info used by the age action.
The fix is to ignore this case where the age is
free and counter not freed yet,
or the counter was freed during the age check.

Fixes: 04a4de756e14 ("net/mlx5: support flow age action with HWS")
Cc: stable@dpdk.org

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_hws_cnt.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_hws_cnt.c b/drivers/net/mlx5/mlx5_hws_cnt.c
index fce7a7e815f..5c738f38caf 100644
--- a/drivers/net/mlx5/mlx5_hws_cnt.c
+++ b/drivers/net/mlx5/mlx5_hws_cnt.c
@@ -170,10 +170,13 @@ mlx5_hws_aging_check(struct mlx5_priv *priv, struct mlx5_hws_cnt_pool *cpool)
 			break;
 		case HWS_AGE_FREE:
 			/*
-			 * AGE parameter with state "FREE" couldn't be pointed
-			 * by any counter since counter is destroyed first.
-			 * Fall-through.
+			 * Since this check is async, we may reach a race condition
+			 * where the age and counter are used in the same rule,
+			 * using the same counter index,
+			 * age was freed first, and counter was not freed yet.
+			 * Aging check can be safely ignored in that case.
 			 */
+			continue;
 		default:
 			MLX5_ASSERT(0);
 			continue;
-- 
2.21.0

[PATCH] net/mlx5: fix panic for non template age rules flush

[Maayan Kashani]

When a user creates a non-template rule with both age and counter actions,
both actions share the same counter.
If a flow flush occurs, the rule is destroyed and the counter is released.
However, the age sampling callback may still access the counter after it
has been freed, leading to a panic on assertion in debug mode.

This creates a race condition: one thread samples the age while another
releases the counter used by the age action.
The fix is to recheck whether the counter is still in use
before triggering an assertion, as it may have been released
after the initial check.

Fixes: 04a4de756e14 ("net/mlx5: support flow age action with HWS")
Cc: stable@dpdk.org

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_hws_cnt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_hws_cnt.c b/drivers/net/mlx5/mlx5_hws_cnt.c
index fce7a7e815f..6cb748b1352 100644
--- a/drivers/net/mlx5/mlx5_hws_cnt.c
+++ b/drivers/net/mlx5/mlx5_hws_cnt.c
@@ -172,8 +172,13 @@ mlx5_hws_aging_check(struct mlx5_priv *priv, struct mlx5_hws_cnt_pool *cpool)
 			/*
 			 * AGE parameter with state "FREE" couldn't be pointed
 			 * by any counter since counter is destroyed first.
-			 * Fall-through.
+			 * Since this check is async, we may reach race condition
+			 * where the counter was freed, after the in_used was checked.
+			 * Fall-through in case the counter is still used and age was freed.
 			 */
+			if (!cpool->pool[i].in_used)
+				continue;
+			/* FALLTHROUGH */
 		default:
 			MLX5_ASSERT(0);
 			continue;
-- 
2.21.0