Re: [PATCH] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

[Ido Schimmel]

Same comment as on the last patch regarding subject prefix

On Tue, Jun 09, 2026 at 08:47:30AM +0000, Wentao Liang wrote:
> When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs,
> the error rollback loop does not correctly revert the preceding
> replacements. The loop decrements the index but fails to update the
> vr pointer, which still points to the VR that caused the failure. As
> a result, the condition and the rollback call always operate on the
> same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple
> times on it while never rolling back the earlier VRs. Those VRs
> continue to hold a reference to new_tree acquired via
> mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree.
> 
> Fix by reinitializing vr inside the error loop with the updated index:
> 
> 	vr = &mlxsw_sp->router->vrs[i];
> 
> so that the loop correctly iterates over all VRs that were actually
> replaced.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: fc922bb0dd94 ("mlxsw: spectrum_router: Use one LPM tree for all virtual routers")
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>