Re: [PATCH] RDMA/mlx5: Guard steering anchor resource destruction on create error

[sashiko-bot@kernel.org]

> From: Li RongQing <lirongqing@baidu.com>
> 
> The steering anchor resources are shared between anchors with the same
> priority and are protected by rule_goto_table_ref.
> 
> When steering anchor creation succeeds but uverbs_copy_to() fails, the
> error path drops the reference acquired for the new anchor. However, it
> unconditionally calls mlx5_steering_anchor_destroy_res(), even when
> other anchors are still using the shared resources.
> 
> This can destroy the shared flow table, flow groups, and rules while
> existing anchors still hold references to them, resulting in a
> use-after-free when those anchors are subsequently cleaned up.
> 
> Only destroy the shared resources when dropping the reference makes
> rule_goto_table_ref zero, consistent with the existing cleanup path.
> 
> Fixes: e1f4a52ac171 ("RDMA/mlx5: Create an indirect flow table for steering anchor")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917085419.1792-1-lirongqing@baidu.com?part=1