[PATCH net v1] net/mlx5: Fix HWS L2-to-L3 tunnel reformat release

[PATCH net v1] net/mlx5: Fix HWS L2-to-L3 tunnel reformat release

[Prathamesh Deshpande]

mlx5_cmd_hws_packet_reformat_alloc() allocates
MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL objects from el2tol3tnl_pools with
MLX5HWS_ACTION_TYP_REFORMAT_L2_TO_TNL_L3.

The deallocation path uses el2tol2tnl_pools with
MLX5HWS_ACTION_TYP_REFORMAT_L2_TO_TNL_L2 instead. This releases the
packet-reformat entry through the wrong pool, corrupting pool accounting
and potentially moving the bulk entry onto the wrong pool list.

Use the matching L2-to-L3 tunnel pool and action type when releasing the
object.

Fixes: aecd9d1020e3 ("net/mlx5: fs, add HWS packet reformat API function")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
index aca77853abb8..60fbb048db10 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
@@ -1396,8 +1396,8 @@ static void mlx5_cmd_hws_packet_reformat_dealloc(struct mlx5_flow_root_namespace
 						    pr_data->data_size);
 		break;
 	case MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL:
-		pr_pool = mlx5_fs_get_pr_encap_pool(dev, &hws_pool->el2tol2tnl_pools,
-						    MLX5HWS_ACTION_TYP_REFORMAT_L2_TO_TNL_L2,
+		pr_pool = mlx5_fs_get_pr_encap_pool(dev, &hws_pool->el2tol3tnl_pools,
+						    MLX5HWS_ACTION_TYP_REFORMAT_L2_TO_TNL_L3,
 						    pr_data->data_size);
 		break;
 	case MLX5_REFORMAT_TYPE_L3_TUNNEL_TO_L2:
-- 
2.43.0

Re: [PATCH net v1] net/mlx5: Fix HWS L2-to-L3 tunnel reformat release

[Alexander Lobakin]

From: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
Date: Mon,  4 May 2026 23:19:17 +0100

> mlx5_cmd_hws_packet_reformat_alloc() allocates
> MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL objects from el2tol3tnl_pools with
> MLX5HWS_ACTION_TYP_REFORMAT_L2_TO_TNL_L3.
> 
> The deallocation path uses el2tol2tnl_pools with
> MLX5HWS_ACTION_TYP_REFORMAT_L2_TO_TNL_L2 instead. This releases the
> packet-reformat entry through the wrong pool, corrupting pool accounting
> and potentially moving the bulk entry onto the wrong pool list.
> 
> Use the matching L2-to-L3 tunnel pool and action type when releasing the
> object.
> 
> Fixes: aecd9d1020e3 ("net/mlx5: fs, add HWS packet reformat API function")
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>

Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>

> ---
>  drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Thanks,
Olek