[PATCH net] nfp: flower: remove merge entry when conntrack offload fails

[PATCH net] nfp: flower: remove merge entry when conntrack offload fails

[Sang-Hoon Choi]

nfp_ct_do_nft_merge() inserts nft_m_entry into nft_merge_tb and
increments nft_merge_count before calling nfp_fl_ct_add_offload(). If
that call fails, the error path removes the entry from its lists and
frees it, but leaves the hash entry and count behind.

Remove the hash entry and undo the count increment before freeing
nft_m_entry.

Fixes: a87ceb3d42af ("nfp: flower: offload tc flows of multiple conntrack zones")
Reported-by: Changyul Lee <lcy8047@gmail.com>
Assisted-by: LLM
Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
---
Compile-tested the affected object with x86_64 allmodconfig
and W=1 (GCC 13.3.0). Base: mainline 3b7cab693ba2bab63774bf5b988e8a61b2ef0f32.
No hardware testing or runtime failure reproduction was performed.

 drivers/net/ethernet/netronome/nfp/flower/conntrack.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/netronome/nfp/flower/conntrack.c b/drivers/net/ethernet/netronome/nfp/flower/conntrack.c
index c983e8b1799d..522ad555e8ec 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/conntrack.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/conntrack.c
@@ -1260,6 +1260,10 @@ static int nfp_ct_do_nft_merge(struct nfp_fl_ct_zone_entry *zt,
 err_nft_ct_offload:
 	nfp_fl_ct_del_offload(zt->priv->app, nft_m_entry->tc_flower_cookie,
 			      nft_m_entry->netdev);
+	WARN_ON_ONCE(rhashtable_remove_fast(&zt->nft_merge_tb,
+					    &nft_m_entry->hash_node,
+					    nfp_nft_ct_merge_params));
+	zt->nft_merge_count--;
 err_nft_ct_merge_insert:
 	list_del(&nft_m_entry->tc_merge_list);
 	list_del(&nft_m_entry->nft_flow_list);

Re: [PATCH net] nfp: flower: remove merge entry when conntrack offload fails

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 02 Oct 2026 19:47:40 +0000 you wrote:
> nfp_ct_do_nft_merge() inserts nft_m_entry into nft_merge_tb and
> increments nft_merge_count before calling nfp_fl_ct_add_offload(). If
> that call fails, the error path removes the entry from its lists and
> frees it, but leaves the hash entry and count behind.
> 
> Remove the hash entry and undo the count increment before freeing
> nft_m_entry.
> 
> [...]

Here is the summary with links:
  - [net] nfp: flower: remove merge entry when conntrack offload fails
    https://git.kernel.org/netdev/net-next/c/a032c035272a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html