[PATCH] net/mlx5: fix meter ASO action leak on release to pool

[PATCH] net/mlx5: fix meter ASO action leak on release to pool

[Shani Peretz]

flow_dv_aso_mtr_release_to_pool() uses memset to zero the entire
mlx5_flow_meter_info struct when returning a meter to the free pool.
This erases the meter_action_g and meter_action_y pointers without
calling destroy_flow_action on the underlying DR ASO actions.

The leak compounds on repeated meter create/destroy cycles because
the caching check in flow_dv_mtr_alloc() — if (!fm.meter_action_g) —
always sees NULL and allocates a new action every time instead of
reusing the existing one.
At shutdown, mlx5_aso_flow_mtrs_mng_close() also skips destruction
since the pointers are already NULL.

Fixed by saving and restoring meter_action_g and meter_action_y across
the memset so the cached actions survive pool recycling and are
properly destroyed only at shutdown.

Fixes: e6100c7b6226 ("net/mlx5: add flow meter pool to manage meter object")
Cc: stable@dpdk.org

Signed-off-by: Shani Peretz <shperetz@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow_dv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index d1bed18077..32e75b063f 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -7286,10 +7286,16 @@ flow_dv_aso_mtr_release_to_pool(struct rte_eth_dev *dev, uint32_t mtr_idx)
 	struct mlx5_aso_mtr_pools_mng *pools_mng =
 				&priv->sh->mtrmng->pools_mng;
 	struct mlx5_aso_mtr *aso_mtr = mlx5_aso_meter_by_idx(priv, mtr_idx);
+	void *meter_action_g;
+	void *meter_action_y;
 
 	MLX5_ASSERT(aso_mtr);
 	rte_spinlock_lock(&pools_mng->mtrsl);
+	meter_action_g = aso_mtr->fm.meter_action_g;
+	meter_action_y = aso_mtr->fm.meter_action_y;
 	memset(&aso_mtr->fm, 0, sizeof(struct mlx5_flow_meter_info));
+	aso_mtr->fm.meter_action_g = meter_action_g;
+	aso_mtr->fm.meter_action_y = meter_action_y;
 	aso_mtr->state = ASO_METER_FREE;
 	LIST_INSERT_HEAD(&pools_mng->meters, aso_mtr, next);
 	rte_spinlock_unlock(&pools_mng->mtrsl);
-- 
2.34.1

Re: [PATCH] net/mlx5: fix meter ASO action leak on release to pool

[Raslan Darawsheh]

Hi,


On 15/03/2026 10:36 AM, Shani Peretz wrote:
> flow_dv_aso_mtr_release_to_pool() uses memset to zero the entire
> mlx5_flow_meter_info struct when returning a meter to the free pool.
> This erases the meter_action_g and meter_action_y pointers without
> calling destroy_flow_action on the underlying DR ASO actions.
> 
> The leak compounds on repeated meter create/destroy cycles because
> the caching check in flow_dv_mtr_alloc() — if (!fm.meter_action_g) —
> always sees NULL and allocates a new action every time instead of
> reusing the existing one.
> At shutdown, mlx5_aso_flow_mtrs_mng_close() also skips destruction
> since the pointers are already NULL.
> 
> Fixed by saving and restoring meter_action_g and meter_action_y across
> the memset so the cached actions survive pool recycling and are
> properly destroyed only at shutdown.
> 
> Fixes: e6100c7b6226 ("net/mlx5: add flow meter pool to manage meter object")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Shani Peretz <shperetz@nvidia.com>
> Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>

Patch applied to next-net-mlx,

Kindest regards
Raslan Darawsheh