When a user creates a non-template rule with both age and counter actions,
both actions share the same counter.
If a flow flush occurs, the rule is destroyed and the counter is released.
However, the age sampling callback may still access the counter after it
has been freed, leading to a panic on assertion in debug mode.
This creates a race condition: one thread samples the age while another
releases the counter used by the age action.
The fix is to recheck whether the counter is still in use
before triggering an assertion, as it may have been released
after the initial check.
Fixes: 04a4de756e14 ("net/mlx5: support flow age action with HWS")
Cc: [email protected]
Signed-off-by: Maayan Kashani <[email protected]>
Acked-by: Dariusz Sosnowski <[email protected]>
---
drivers/net/mlx5/mlx5_hws_cnt.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/mlx5/mlx5_hws_cnt.c b/drivers/net/mlx5/mlx5_hws_cnt.c
index fce7a7e815f..6cb748b1352 100644
--- a/drivers/net/mlx5/mlx5_hws_cnt.c
+++ b/drivers/net/mlx5/mlx5_hws_cnt.c
@@ -172,8 +172,13 @@ mlx5_hws_aging_check(struct mlx5_priv *priv, struct
mlx5_hws_cnt_pool *cpool)
/*
* AGE parameter with state "FREE" couldn't be pointed
* by any counter since counter is destroyed first.
- * Fall-through.
+ * Since this check is async, we may reach race
condition
+ * where the counter was freed, after the in_used was
checked.
+ * Fall-through in case the counter is still used and
age was freed.
*/
+ if (!cpool->pool[i].in_used)
+ continue;
+ /* FALLTHROUGH */
default:
MLX5_ASSERT(0);
continue;
--
2.21.0
