From: Kery Qi <qikeyu2017@gmail.com>
To: tariqt@nvidia.com, andrew+netdev@lunn.ch, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com
Cc: jackm@dev.mellanox.co.il, ogerlitz@mellanox.com,
monis@mellanox.com, netdev@vger.kernel.org,
linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org,
Kery Qi <qikeyu2017@gmail.com>
Subject: [PATCH] net/mlx4: fix MAC table total count corruption in __mlx4_unregister_mac()
Date: Fri, 23 Jan 2026 02:39:07 +0800 [thread overview]
Message-ID: <20260122183906.2015-2-qikeyu2017@gmail.com> (raw)
In __mlx4_unregister_mac(), when operating in mf_bonded mode
(SR-IOV with bonding), it appears that the code might be incorrectly
decrementing table->total instead of dup_table->total when cleaning
up the duplicate table entry.
If this is the case, it would cause the primary table's total counter
to be decremented twice (once for itself and once when it should
decrement the duplicate table), leading to counter corruption.
Over time, table->total could become negative, which would
break the "table->total == table->max" fullness check in
__mlx4_register_mac().
The registration path correctly increments both counters:
++table->total;
if (dup) {
...
++dup_table->total;
}
However, the unregistration path seems to have a typo:
--table->total;
if (dup) {
...
--table->total; // Should this be --dup_table->total?
Fixes: 5f61385d2ebc2 ("net/mlx4_core: Keep VLAN/MAC tables mirrored in multifunc HA mode")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
drivers/net/ethernet/mellanox/mlx4/port.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index e3d0b13c1610..6d0295c471da 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -410,7 +410,7 @@ void __mlx4_unregister_mac(struct mlx4_dev *dev, u8 port, u64 mac)
if (mlx4_set_port_mac_table(dev, dup_port, dup_table->entries))
mlx4_warn(dev, "Fail to set mac in duplicate port %d during unregister\n", dup_port);
- --table->total;
+ --dup_table->total;
}
out:
if (dup) {
--
2.34.1
next reply other threads:[~2026-01-22 18:40 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-22 18:39 Kery Qi [this message]
2026-01-27 3:47 ` [PATCH] net/mlx4: fix MAC table total count corruption in __mlx4_unregister_mac() Jakub Kicinski
2026-01-27 6:26 ` Tariq Toukan
2026-01-27 16:38 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260122183906.2015-2-qikeyu2017@gmail.com \
--to=qikeyu2017@gmail.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=jackm@dev.mellanox.co.il \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=monis@mellanox.com \
--cc=netdev@vger.kernel.org \
--cc=ogerlitz@mellanox.com \
--cc=pabeni@redhat.com \
--cc=tariqt@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox