Re: [PATCH] net/mlx5e: TC, release meter if rule offload fails

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The new failure path in mlx5e_tc_rule_offload()
  (drivers/net/ethernet/mellanox/mlx5/core/en_tc.c) calls…

--

net/mlx5e: TC, release meter if rule offload fails

When mlx5_eswitch_add_offloaded_rule() fails, this patch makes
mlx5e_tc_rule_offload() release the flow meter and the post meter state
that mlx5e_tc_add_flow_meter() set up. Before the patch, that meter
reference leaked when mlx5e_tc_add_fdb_flow() failed.

> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 708b7987ea4cd..17bd92529a44a 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c

[ ... ]

> @@ -503,9 +505,14 @@ mlx5e_tc_rule_offload(struct mlx5e_priv *priv,
>  		err = mlx5e_tc_add_flow_meter(priv, attr);
>  		if (err)
>  			return ERR_PTR(err);
> +		meter_added = true;
>  	}
>  
> -	return mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
> +	rule = mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
> +	if (IS_ERR(rule) && meter_added)
> +		mlx5e_tc_del_flow_meter(esw, attr);

[Severity: Medium]
Can this lead to a double free of the post meter and an extra meter put?

mlx5e_tc_del_flow_meter() kfree()s attr->meter_attr.post_meter and drops
the attr->meter_attr.meter reference, but it does not clear either
pointer:

mlx5e_tc_del_flow_meter() {
	mlx5e_post_meter_cleanup(esw, attr->meter_attr.post_meter);
	mlx5e_tc_meter_put(attr->meter_attr.meter);
}

attr->dest_ft and the FWD_DEST action bit set by
mlx5e_tc_add_flow_meter() also stay in place.

mlx5e_tc_rule_unoffload() treats a non-NULL meter pointer as a live
reference:

	if (attr->meter_attr.meter)
		mlx5e_tc_del_flow_meter(esw, attr);

So any later unoffload of the same attr releases the meter again.

That later unoffload looks reachable through mlx5e_reoffload_encap() in
en/tc_tun_encap.c. Consider a fast path FDB flow with a police or MTU
meter that redirects to an encap device:

mlx5e_invalidate_encap()
  mlx5e_tc_unoffload_fdb_rules(esw, flow, flow->attr)
    releases meter ref #1 and post_meter P1

mlx5e_reoffload_encap()
  mlx5e_tc_offload_fdb_rules()
    mlx5e_tc_rule_offload()
      mlx5e_tc_add_flow_meter()          takes ref #2 and P2
      mlx5_eswitch_add_offloaded_rule()  fails
      mlx5e_tc_del_flow_meter()          frees P2, puts ref #2,
                                         attr->meter_attr still set

mlx5e_reoffload_encap() then marks the flow as offloaded even when this
step fails:

		rule = mlx5e_tc_offload_fdb_rules(esw, flow, spec, flow->attr);
		if (IS_ERR(rule)) {
			mlx5e_tc_unoffload_flow_post_acts(flow);
			...
		}
		...
		flow_flag_set(flow, OFFLOADED);

The flow is now OFFLOADED and not SLOW. The next flow delete
(mlx5e_tc_del_fdb_flow()) or route event (mlx5e_invalidate_encap()) goes
through:

mlx5e_tc_unoffload_fdb_rules()
  mlx5e_tc_rule_unoffload()
    mlx5e_tc_del_flow_meter()
      mlx5e_post_meter_cleanup()  reads freed P2->type, destroys its HW
                                  objects again, kfree()s P2 again
      mlx5e_tc_meter_put()        drops a reference that is no longer
                                  held

The extra mlx5e_tc_meter_put() could also destroy a meter that other
flows using the same police index still rely on.

Before this patch, P2 and ref #2 leaked at the failure point and were
released exactly once by the later unoffload. With this patch they are
released twice.

The same mlx5e_tc_rule_unoffload() call also passes the stale
flow->rule[0] to mlx5_eswitch_del_offloaded_rule() on this path. That
problem already existed and comes from the unconditional OFFLOADED in
mlx5e_reoffload_encap(). The split_count failure branch in
mlx5e_tc_offload_fdb_rules() already left similar stale meter state
before this patch. The main path this commit targets, where
mlx5e_tc_add_fdb_flow() fails, does look correct.

Would it help to set attr->meter_attr.meter and
attr->meter_attr.post_meter to NULL, and undo the attr->dest_ft change,
after mlx5e_tc_del_flow_meter() in this failure path? A later unoffload
would then skip the meter release.

> +
> +	return rule;
>  }

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261103102856.1340672-1-vulab%40iscas.ac.cn