Hi, > -----Original Message----- > From: Maayan Kashani <[email protected]> > Sent: Sunday, August 16, 2026 4:15 PM > To: [email protected] > Cc: Maayan Kashani <[email protected]>; Raslan Darawsheh > <[email protected]>; [email protected]; Dariusz Sosnowski > <[email protected]>; Slava Ovsiienko <[email protected]>; Bing > Zhao <[email protected]>; Ori Kam <[email protected]>; Suanming Mou > <[email protected]>; Matan Azrad <[email protected]>; Gregory Etelson > <[email protected]> > Subject: [PATCH] net/mlx5: fix HWS sample action table leak on quit > > Destroy the composite dest_array mirror action before releasing its clone > destinations. Releasing a JUMP clone can drop the last group table > reference while the dest_array still points at that table, leaving the > firmware flow table objects leaked on port close. > > Fixes: 3564e928c759 ("net/mlx5: support HWS flow mirror action") > Cc: [email protected] > > Signed-off-by: Maayan Kashani <[email protected]> > --- > drivers/net/mlx5/mlx5_flow_hw.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/mlx5/mlx5_flow_hw.c > b/drivers/net/mlx5/mlx5_flow_hw.c index 1cffdcc54df..9abd1770a9b 100644 > --- a/drivers/net/mlx5/mlx5_flow_hw.c > +++ b/drivers/net/mlx5/mlx5_flow_hw.c > @@ -14629,10 +14629,18 @@ mlx5_hw_mirror_destroy(struct rte_eth_dev *dev, > struct mlx5_mirror *mirror) > uint32_t i; > > mlx5_indirect_list_remove_entry(&mirror->indirect); > - for (i = 0; i < mirror->clones_num; i++) > - mlx5_mirror_destroy_clone(dev, &mirror->clone[i]); > + /* > + * The mirror action is a composite dest_array that references each > + * clone destination (jump table or Rx queue). It must be destroyed > + * before the clones so the underlying destinations are no longer > + * referenced when they are released; otherwise releasing a clone > can > + * drop the last reference to a group table and destroy it while the > + * dest_array still points at it, leaking the firmware flow table. > + */ > if (mirror->mirror_action) > mlx5dr_action_destroy(mirror->mirror_action); > + for (i = 0; i < mirror->clones_num; i++) > + mlx5_mirror_destroy_clone(dev, &mirror->clone[i]); > mlx5_free(mirror); > } > > -- > 2.21.0
Acked-by: Bing Zhao <[email protected]>
