From a032c035272aff415a3ac7ec48bd16aada5fc4bf Mon Sep 17 00:00:00 2001 From: Sang-Hoon Choi Date: Fri, 2 Oct 2026 19:47:40 +0000 Subject: nfp: flower: remove merge entry when conntrack offload fails nfp_ct_do_nft_merge() inserts nft_m_entry into nft_merge_tb and increments nft_merge_count before calling nfp_fl_ct_add_offload(). If that call fails, the error path removes the entry from its lists and frees it, but leaves the hash entry and count behind. Remove the hash entry and undo the count increment before freeing nft_m_entry. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Fixes: a87ceb3d42af ("nfp: flower: offload tc flows of multiple conntrack zones") Reported-by: Changyul Lee Signed-off-by: Sang-Hoon Choi Link: https://patch.msgid.link/20261003.final049.214b9988b1e1f0a7@gmail.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/netronome/nfp/flower/conntrack.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/netronome/nfp/flower/conntrack.c b/drivers/net/ethernet/netronome/nfp/flower/conntrack.c index c983e8b1799d..522ad555e8ec 100644 --- a/drivers/net/ethernet/netronome/nfp/flower/conntrack.c +++ b/drivers/net/ethernet/netronome/nfp/flower/conntrack.c @@ -1260,6 +1260,10 @@ static int nfp_ct_do_nft_merge(struct nfp_fl_ct_zone_entry *zt, err_nft_ct_offload: nfp_fl_ct_del_offload(zt->priv->app, nft_m_entry->tc_flower_cookie, nft_m_entry->netdev); + WARN_ON_ONCE(rhashtable_remove_fast(&zt->nft_merge_tb, + &nft_m_entry->hash_node, + nfp_nft_ct_merge_params)); + zt->nft_merge_count--; err_nft_ct_merge_insert: list_del(&nft_m_entry->tc_merge_list); list_del(&nft_m_entry->nft_flow_list); -- cgit v1.2.3