[PATCH] RDMA/mlx5: Guard steering anchor resource destruction on create error

[PATCH] RDMA/mlx5: Guard steering anchor resource destruction on create error

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

The steering anchor resources are shared between anchors with the same
priority and are protected by rule_goto_table_ref.

When steering anchor creation succeeds but uverbs_copy_to() fails, the
error path drops the reference acquired for the new anchor. However, it
unconditionally calls mlx5_steering_anchor_destroy_res(), even when
other anchors are still using the shared resources.

This can destroy the shared flow table, flow groups, and rules while
existing anchors still hold references to them, resulting in a
use-after-free when those anchors are subsequently cleaned up.

Only destroy the shared resources when dropping the reference makes
rule_goto_table_ref zero, consistent with the existing cleanup path.

Fixes: e1f4a52ac171 ("RDMA/mlx5: Create an indirect flow table for steering anchor")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/hw/mlx5/fs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c
index e27826c..034ab55 100644
--- a/drivers/infiniband/hw/mlx5/fs.c
+++ b/drivers/infiniband/hw/mlx5/fs.c
@@ -3056,8 +3056,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_STEERING_ANCHOR_CREATE)(
 	return 0;
 
 destroy_res:
-	--ft_prio->anchor.rule_goto_table_ref;
-	mlx5_steering_anchor_destroy_res(ft_prio);
+	if (!--ft_prio->anchor.rule_goto_table_ref)
+		mlx5_steering_anchor_destroy_res(ft_prio);
 put_flow_table:
 	put_flow_table(dev, ft_prio, true);
 free_obj:
-- 
2.9.4

Re: [PATCH] RDMA/mlx5: Guard steering anchor resource destruction on create error

[sashiko-bot]

> From: Li RongQing <lirongqing@baidu.com>
> 
> The steering anchor resources are shared between anchors with the same
> priority and are protected by rule_goto_table_ref.
> 
> When steering anchor creation succeeds but uverbs_copy_to() fails, the
> error path drops the reference acquired for the new anchor. However, it
> unconditionally calls mlx5_steering_anchor_destroy_res(), even when
> other anchors are still using the shared resources.
> 
> This can destroy the shared flow table, flow groups, and rules while
> existing anchors still hold references to them, resulting in a
> use-after-free when those anchors are subsequently cleaned up.
> 
> Only destroy the shared resources when dropping the reference makes
> rule_goto_table_ref zero, consistent with the existing cleanup path.
> 
> Fixes: e1f4a52ac171 ("RDMA/mlx5: Create an indirect flow table for steering anchor")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917085419.1792-1-lirongqing@baidu.com?part=1

Re: [PATCH] RDMA/mlx5: Guard steering anchor resource destruction on create error

[Leon Romanovsky]

On Thu, 17 Sep 2026 16:54:19 +0800, lirongqing wrote:
> The steering anchor resources are shared between anchors with the same
> priority and are protected by rule_goto_table_ref.
> 
> When steering anchor creation succeeds but uverbs_copy_to() fails, the
> error path drops the reference acquired for the new anchor. However, it
> unconditionally calls mlx5_steering_anchor_destroy_res(), even when
> other anchors are still using the shared resources.
> 
> [...]

Applied, thanks!

[1/1] RDMA/mlx5: Guard steering anchor resource destruction on create error
      https://git.kernel.org/rdma/rdma/c/193aaf5b57f05d

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>