[PATCH v2] net/mlx5e: TC, fix internal port leak when a flow is reoffloaded

[Wentao Liang]

For a flow originating from an OVS internal port,
mlx5e_tc_add_fdb_flow() takes a reference on the internal port and stores
it in the flow's esw attribute.

If the flow cannot be offloaded because the encap route is not available
(-ENETUNREACH) on a multipath LAG setup, __mlx5e_add_fdb_flow() keeps the
flow on the unready list instead of freeing it. When
mlx5e_tc_reoffload_flows_work() retries, mlx5e_tc_add_fdb_flow() takes
another reference and overwrites the stored pointer, so the previous
reference is never dropped.

Only look up the internal port if the flow does not hold a reference
already; the reference is released together with the flow attributes.

The candidate was found by a static analysis tool we run over the tree,
which reports reference-count imbalance candidates. DeepSeek-V4.1-Flash
and GPT-6.1 Sol were then used to audit the candidate and to prepare
this fix. The leak was identified by code inspection only and was not
triggered, so there is no stack trace or error message to report. The
patch was compile-tested only and was not tested on mlx5 hardware.

Fixes: 166f431ec6be ("net/mlx5e: Add indirect tc offload of ovs internal port")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
Changes in v2:
- Fold the internal port check into the outer condition, as suggested by
  Tariq Toukan, instead of re-indenting the lookup.
- Describe in the commit message how the issue was found and how it was
  tested, as requested by netdev-bot.
- Drop Cc: stable@xxxxxxxxxxxxxxx: the leak is only reachable when a flow
  is retried after the encap route lookup fails with -ENETUNREACH on a
  multipath LAG setup.

 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 708b7987ea4c..88e620654f9f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1981,7 +1981,8 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
 			goto err_out;
 	}
 
-	if (netif_is_ovs_master(parse_attr->filter_dev)) {
+	if (netif_is_ovs_master(parse_attr->filter_dev) &&
+	    !esw_attr->int_port) {
 		struct mlx5e_tc_int_port *int_port;
 
 		if (attr->chain) {
-- 
2.34.1