[PATCH 0/2] net/bnxt/tf_core: fix ignored return of EM delete

[PATCH 0/2] net/bnxt/tf_core: fix ignored return of EM delete

[Denis Sergeev]

This series fixes a missing error check in the bnxt TF core EM delete
path that can lead to HW/SW state inconsistency.

The return value of tfc_em_delete_raw() in tfc_em_delete() was silently
discarded, so if the HW EM entry removal fails, the function continues
to free the corresponding SW pool entry, creating stale flow matches
or incorrect pool slot reuse.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Patches:
- net/bnxt/tf_core: fix ignored return of EM delete
- mailmap: add Denis Sergeev

Denis Sergeev (2):
  net/bnxt/tf_core: fix ignored return of EM delete
  mailmap: add Denis Sergeev

 .mailmap                             | 1 +
 drivers/net/bnxt/tf_core/v3/tfc_em.c | 5 +++++
 2 files changed, 6 insertions(+)

-- 
2.50.1

[PATCH 1/2] net/bnxt/tf_core: fix ignored return of EM delete

[Denis Sergeev]

The return value of tfc_em_delete_raw() in tfc_em_delete() was
silently discarded: rc was unconditionally overwritten by the
subsequent tfc_cpm_get_cmm_inst() call without any error check.

If tfc_em_delete_raw() fails, the HW EM entry is not removed but
the function continues to free the corresponding SW pool entry,
creating a HW/SW state inconsistency that can lead to stale flow
matches or incorrect pool slot reuse.

Add an error check after the call and return -EINVAL on failure.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
Cc: stable@dpdk.org

Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
---
 drivers/net/bnxt/tf_core/v3/tfc_em.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/bnxt/tf_core/v3/tfc_em.c b/drivers/net/bnxt/tf_core/v3/tfc_em.c
index 3fe4dbe3fe..4c126dc2f4 100644
--- a/drivers/net/bnxt/tf_core/v3/tfc_em.c
+++ b/drivers/net/bnxt/tf_core/v3/tfc_em.c
@@ -661,6 +661,11 @@ int tfc_em_delete(struct tfc *tfcp, struct tfc_em_delete_parms *parms)
 			       &db_offset
 #endif
 			       );
+	if (rc != 0) {
+		PMD_DRV_LOG_LINE(ERR, "tfc_em_delete_raw() failed: %s",
+				 strerror(-rc));
+		return -EINVAL;
+	}
 
 	record_offset = REMOVE_POOL_FROM_OFFSET(pi.lkup_pool_sz_exp,
 						record_offset);
-- 
2.50.1

Re: [PATCH 1/2] net/bnxt/tf_core: fix ignored return of EM delete

[Kishore Padmanabha]

[-- Attachment #1.1: Type: text/plain, Size: 1940 bytes --]

On Tue, May 19, 2026 at 12:44 AM Denis Sergeev <denserg.edu@gmail.com>
wrote:

> The return value of tfc_em_delete_raw() in tfc_em_delete() was
> silently discarded: rc was unconditionally overwritten by the
> subsequent tfc_cpm_get_cmm_inst() call without any error check.
>
> If tfc_em_delete_raw() fails, the HW EM entry is not removed but
> the function continues to free the corresponding SW pool entry,
> creating a HW/SW state inconsistency that can lead to stale flow
> matches or incorrect pool slot reuse.
>
> Add an error check after the call and return -EINVAL on failure.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
> Cc: stable@dpdk.org
>
> Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
> ---
>  drivers/net/bnxt/tf_core/v3/tfc_em.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/bnxt/tf_core/v3/tfc_em.c
> b/drivers/net/bnxt/tf_core/v3/tfc_em.c
> index 3fe4dbe3fe..4c126dc2f4 100644
> --- a/drivers/net/bnxt/tf_core/v3/tfc_em.c
> +++ b/drivers/net/bnxt/tf_core/v3/tfc_em.c
> @@ -661,6 +661,11 @@ int tfc_em_delete(struct tfc *tfcp, struct
> tfc_em_delete_parms *parms)
>                                &db_offset
>  #endif
>                                );
> +       if (rc != 0) {
> +               PMD_DRV_LOG_LINE(ERR, "tfc_em_delete_raw() failed: %s",
> +                                strerror(-rc));
> +               return -EINVAL;
> +       }
>
>         record_offset = REMOVE_POOL_FROM_OFFSET(pi.lkup_pool_sz_exp,
>                                                 record_offset);
>
This change is not required, even if deletion of the HW entry fails, it
should continue to delete the SW state, since at the end all the HW entries
are invalidated. Have you been able to reproduce a scenario where this
failure is seen.

> --
> 2.50.1
>
>

[-- Attachment #1.2: Type: text/html, Size: 2800 bytes --]

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5493 bytes --]

Re: [PATCH 1/2] net/bnxt/tf_core: fix ignored return of EM delete

[Denis Sergeev]

[-- Attachment #1: Type: text/plain, Size: 2486 bytes --]

On 5/20/26 12:02 AM, Kishore Padmanabha wrote:
>
> On Tue, May 19, 2026 at 12:44 AM Denis Sergeev <denserg.edu@gmail.com> 
> wrote:
>
>     The return value of tfc_em_delete_raw() in tfc_em_delete() was
>     silently discarded: rc was unconditionally overwritten by the
>     subsequent tfc_cpm_get_cmm_inst() call without any error check.
>
>     If tfc_em_delete_raw() fails, the HW EM entry is not removed but
>     the function continues to free the corresponding SW pool entry,
>     creating a HW/SW state inconsistency that can lead to stale flow
>     matches or incorrect pool slot reuse.
>
>     Add an error check after the call and return -EINVAL on failure.
>
>     Found by Linux Verification Center (linuxtesting.org
>     <http://linuxtesting.org>) with SVACE.
>
>     Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
>     Cc: stable@dpdk.org
>
>     Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
>     ---
>      drivers/net/bnxt/tf_core/v3/tfc_em.c | 5 +++++
>      1 file changed, 5 insertions(+)
>
>     diff --git a/drivers/net/bnxt/tf_core/v3/tfc_em.c
>     b/drivers/net/bnxt/tf_core/v3/tfc_em.c
>     index 3fe4dbe3fe..4c126dc2f4 100644
>     --- a/drivers/net/bnxt/tf_core/v3/tfc_em.c
>     +++ b/drivers/net/bnxt/tf_core/v3/tfc_em.c
>     @@ -661,6 +661,11 @@ int tfc_em_delete(struct tfc *tfcp, struct
>     tfc_em_delete_parms *parms)
>                                    &db_offset
>      #endif
>                                    );
>     +       if (rc != 0) {
>     +               PMD_DRV_LOG_LINE(ERR, "tfc_em_delete_raw() failed:
>     %s",
>     +                                strerror(-rc));
>     +               return -EINVAL;
>     +       }
>
>             record_offset = REMOVE_POOL_FROM_OFFSET(pi.lkup_pool_sz_exp,
>     record_offset);
>
> This change is not required, even if deletion of the HW entry fails, 
> it should continue to delete the SW state, since at the end all the HW 
> entries are invalidated. Have you been able to reproduce a scenario 
> where this failure is seen.
>
>     -- 
>     2.50.1
>
Thanks for the review. I'll drop this patch.

The issue was flagged by a static analyzer that caught the discarded
return value of tfc_em_delete_raw(). Over the past week I tried to
reproduce an actual failure at runtime, but I couldn't. So it seems
this failure doesn't occur in real runtime.

-- 
Best regards,
Denis Sergeev

[-- Attachment #2: Type: text/html, Size: 4428 bytes --]

[PATCH 2/2] mailmap: add Denis Sergeev

[Denis Sergeev]

Add my name and email mapping to .mailmap

Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
---
 .mailmap | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.mailmap b/.mailmap
index 4d26d9c286..3d0fc8c7da 100644
--- a/.mailmap
+++ b/.mailmap
@@ -373,6 +373,7 @@ Deirdre O'Connor <deirdre.o.connor@intel.com>
 Dekel Peled <dekelp@nvidia.com> <dekelp@mellanox.com>
 Dengdui Huang <huangdengdui@huawei.com>
 Denis Pryazhennikov <denis.pryazhennikov@arknetworks.am>
+Denis Sergeev <denserg.edu@gmail.com>
 Dennis Marinus <dmarinus@amazon.com>
 Derek Chickles <derek.chickles@caviumnetworks.com>
 Des O Dea <des.j.o.dea@intel.com>
-- 
2.50.1