diff options
| author | Alexandre Cassen <acassen@corp.free.fr> | 2026-10-12 12:05:53 +0200 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-10-20 13:01:26 +0200 |
| commit | d730ca15cf3e4806e38fa8fc6f2af8d7405ef2a4 (patch) | |
| tree | 9124167e877fe447acfd2b5ca994198dbb3ac9c3 /drivers | |
| parent | fece8420e76fe53ee84f0439f18d026b4c7641da (diff) | |
| download | linux-d730ca15cf3e4806e38fa8fc6f2af8d7405ef2a4.tar.gz linux-d730ca15cf3e4806e38fa8fc6f2af8d7405ef2a4.zip | |
net/mlx5: HWS, fix reformat pool creation race
mlx5_fs_get_pr_encap_pool() inserts a new pool when the lookup misses.
Two callers allocating the first reformat of a size at once both
create one and the second fails with -EBUSY. TC serializes these
allocations under encap_tbl_lock while RDMA flow actions on the FDB
don't.
Sashiko AI review of an earlier series spotted this issue.
Tested for regressions on ConnectX-7 with firmware 28.48.1000.
Fixes: aecd9d1020e3 ("net/mlx5: fs, add HWS packet reformat API function")
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Alexandre Cassen <acassen@corp.free.fr>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261012100555.1317878-2-acassen@corp.free.fr
Acked-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c index 54761754e657..fcef2b64f62c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c @@ -1229,7 +1229,7 @@ static struct mlx5_fs_pool * mlx5_fs_get_pr_encap_pool(struct mlx5_core_dev *dev, struct xarray *pr_pools, enum mlx5hws_action_type reformat_type, size_t size) { - struct mlx5_fs_pool *pr_pool; + struct mlx5_fs_pool *pr_pool, *old; unsigned long index = size; int err; @@ -1243,13 +1243,14 @@ mlx5_fs_get_pr_encap_pool(struct mlx5_core_dev *dev, struct xarray *pr_pools, err = mlx5_fs_hws_pr_pool_init(pr_pool, dev, size, reformat_type); if (err) goto free_pr_pool; - err = xa_insert(pr_pools, index, pr_pool, GFP_KERNEL); - if (err) - goto cleanup_pr_pool; - return pr_pool; + old = xa_cmpxchg(pr_pools, index, NULL, pr_pool, GFP_KERNEL); + if (!old) + return pr_pool; -cleanup_pr_pool: mlx5_fs_hws_pr_pool_cleanup(pr_pool); + kfree(pr_pool); + return xa_is_err(old) ? ERR_PTR(xa_err(old)) : old; + free_pr_pool: kfree(pr_pool); return ERR_PTR(err); |