Destroy the composite dest_array mirror action before releasing its
clone destinations. Releasing a JUMP clone can drop the last group
table reference while the dest_array still points at that table,
leaving the firmware flow table objects leaked on port close.
Fixes: 3564e928c759 ("net/mlx5: support HWS flow mirror action")
Cc: [email protected]
Signed-off-by: Maayan Kashani <[email protected]>
---
drivers/net/mlx5/mlx5_flow_hw.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 1cffdcc54df..9abd1770a9b 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -14629,10 +14629,18 @@ mlx5_hw_mirror_destroy(struct rte_eth_dev *dev,
struct mlx5_mirror *mirror)
uint32_t i;
mlx5_indirect_list_remove_entry(&mirror->indirect);
- for (i = 0; i < mirror->clones_num; i++)
- mlx5_mirror_destroy_clone(dev, &mirror->clone[i]);
+ /*
+ * The mirror action is a composite dest_array that references each
+ * clone destination (jump table or Rx queue). It must be destroyed
+ * before the clones so the underlying destinations are no longer
+ * referenced when they are released; otherwise releasing a clone can
+ * drop the last reference to a group table and destroy it while the
+ * dest_array still points at it, leaking the firmware flow table.
+ */
if (mirror->mirror_action)
mlx5dr_action_destroy(mirror->mirror_action);
+ for (i = 0; i < mirror->clones_num; i++)
+ mlx5_mirror_destroy_clone(dev, &mirror->clone[i]);
mlx5_free(mirror);
}
--
2.21.0
