[PATCH net] net/mlx5: HWS, fix matcher leak on resize target setup failure

[PATCH net] net/mlx5: HWS, fix matcher leak on resize target setup failure

[Dawei Feng]

hws_bwc_matcher_move() allocates a replacement matcher before setting it
as the resize target. If mlx5hws_matcher_resize_set_target() fails, the
replacement matcher is not attached anywhere and is leaked.

Fix the leak by destroying the replacement matcher before returning from
the resize-target failure path.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.

An x86_64 allyesconfig build showed no new warnings. As we do not have a
mlx5 HWS-capable device to test with, no runtime testing was able to be
performed.

Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
---
 drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
index eae02bc74221..3bcf412a08c4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
@@ -205,6 +205,7 @@ static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher)
 	ret = mlx5hws_matcher_resize_set_target(old_matcher, new_matcher);
 	if (ret) {
 		mlx5hws_err(ctx, "Rehash error: failed setting resize target\n");
+		mlx5hws_matcher_destroy(new_matcher);
 		return ret;
 	}
 
-- 
2.34.1

Re: [PATCH net] net/mlx5: HWS, fix matcher leak on resize target setup failure

[Yevgeny Kliteynik]

On 29-Jun-26 09:40, Dawei Feng wrote:
> hws_bwc_matcher_move() allocates a replacement matcher before setting it
> as the resize target. If mlx5hws_matcher_resize_set_target() fails, the
> replacement matcher is not attached anywhere and is leaked.
> 
> Fix the leak by destroying the replacement matcher before returning from
> the resize-target failure path.
> 
> The bug was first flagged by an experimental analysis tool we are
> developing for kernel memory-management bugs while analyzing
> v6.13-rc1. The tool is still under development and is not yet publicly
> available. Manual inspection confirms that the bug is still
> present in v7.1.1.
> 
> An x86_64 allyesconfig build showed no new warnings. As we do not have a
> mlx5 HWS-capable device to test with, no runtime testing was able to be
> performed.
> 
> Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
> index eae02bc74221..3bcf412a08c4 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
> @@ -205,6 +205,7 @@ static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher)
>   	ret = mlx5hws_matcher_resize_set_target(old_matcher, new_matcher);
>   	if (ret) {
>   		mlx5hws_err(ctx, "Rehash error: failed setting resize target\n");
> +		mlx5hws_matcher_destroy(new_matcher);
>   		return ret;
>   	}
>   

Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com>

Re: [PATCH net] net/mlx5: HWS, fix matcher leak on resize target setup failure

[Paolo Abeni]

On 6/29/26 8:40 AM, Dawei Feng wrote:
> hws_bwc_matcher_move() allocates a replacement matcher before setting it
> as the resize target. If mlx5hws_matcher_resize_set_target() fails, the
> replacement matcher is not attached anywhere and is leaked.
> 
> Fix the leak by destroying the replacement matcher before returning from
> the resize-target failure path.
> 
> The bug was first flagged by an experimental analysis tool we are
> developing for kernel memory-management bugs while analyzing
> v6.13-rc1. The tool is still under development and is not yet publicly
> available. Manual inspection confirms that the bug is still
> present in v7.1.1.
> 
> An x86_64 allyesconfig build showed no new warnings. As we do not have a
> mlx5 HWS-capable device to test with, no runtime testing was able to be
> performed.
> 
> Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>

@nvidia team, double checking I did not miss any relevant communication.
The last process update I recall is that one of the people listed in
maintainer file will ack patches for us to merge directly into the
net/net-next trees.

Should we consider any ack from @nvidia sufficient to take over?

Thanks,

Paolo

Re: [PATCH net] net/mlx5: HWS, fix matcher leak on resize target setup failure

[Tariq Toukan]

On 01/07/2026 17:38, Paolo Abeni wrote:
> On 6/29/26 8:40 AM, Dawei Feng wrote:
>> hws_bwc_matcher_move() allocates a replacement matcher before setting it
>> as the resize target. If mlx5hws_matcher_resize_set_target() fails, the
>> replacement matcher is not attached anywhere and is leaked.
>>
>> Fix the leak by destroying the replacement matcher before returning from
>> the resize-target failure path.
>>
>> The bug was first flagged by an experimental analysis tool we are
>> developing for kernel memory-management bugs while analyzing
>> v6.13-rc1. The tool is still under development and is not yet publicly
>> available. Manual inspection confirms that the bug is still
>> present in v7.1.1.
>>
>> An x86_64 allyesconfig build showed no new warnings. As we do not have a
>> mlx5 HWS-capable device to test with, no runtime testing was able to be
>> performed.
>>
>> Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
> 
> @nvidia team, double checking I did not miss any relevant communication.
> The last process update I recall is that one of the people listed in
> maintainer file will ack patches for us to merge directly into the
> net/net-next trees.
> 

Ack.

> Should we consider any ack from @nvidia sufficient to take over?
> 
> Thanks,
> 
> Paolo
> 
> 

Acked-by: Tariq Toukan <tariqt@nvidia.com>

Re: [PATCH net] net/mlx5: HWS, fix matcher leak on resize target setup failure

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Mon, 29 Jun 2026 14:40:49 +0800 you wrote:
> hws_bwc_matcher_move() allocates a replacement matcher before setting it
> as the resize target. If mlx5hws_matcher_resize_set_target() fails, the
> replacement matcher is not attached anywhere and is leaked.
> 
> Fix the leak by destroying the replacement matcher before returning from
> the resize-target failure path.
> 
> [...]

Here is the summary with links:
  - [net] net/mlx5: HWS, fix matcher leak on resize target setup failure
    https://git.kernel.org/netdev/net/c/bb09d0e64eca

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html