mlx5_fs_get_pr_encap_pool() inserts a new pool when the lookup misses.
Two callers allocating the first reformat of a size at once both
create one and the second fails with -EBUSY. TC serializes these
allocations under encap_tbl_lock while RDMA flow actions on the FDB
don't.
Sashiko AI review of an earlier series spotted this issue.
Tested for regressions on ConnectX-7 with firmware 28.48.1000.
Fixes: aecd9d1020e3 ("net/mlx5: fs, add HWS packet reformat API function")
Signed-off-by: Alexandre Cassen <redacted>
---
.../mellanox/mlx5/core/steering/hws/fs_hws.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
index 5a172c572a68..66edb42268cb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
@@ -1228,7 +1228,7 @@ static struct mlx5_fs_pool *
mlx5_fs_get_pr_encap_pool(struct mlx5_core_dev *dev, struct xarray *pr_pools,
enum mlx5hws_action_type reformat_type, size_t size)
{
- struct mlx5_fs_pool *pr_pool;
+ struct mlx5_fs_pool *pr_pool, *old;
unsigned long index = size;
int err;
@@ -1242,13 +1242,14 @@ mlx5_fs_get_pr_encap_pool(struct mlx5_core_dev *dev, struct xarray *pr_pools,
err = mlx5_fs_hws_pr_pool_init(pr_pool, dev, size, reformat_type);
if (err)
goto free_pr_pool;
- err = xa_insert(pr_pools, index, pr_pool, GFP_KERNEL);
- if (err)
- goto cleanup_pr_pool;
- return pr_pool;
+ old = xa_cmpxchg(pr_pools, index, NULL, pr_pool, GFP_KERNEL);
+ if (!old)
+ return pr_pool;
-cleanup_pr_pool:
mlx5_fs_hws_pr_pool_cleanup(pr_pool);
+ kfree(pr_pool);
+ return xa_is_err(old) ? ERR_PTR(xa_err(old)) : old;
+
free_pr_pool:
kfree(pr_pool);
return ERR_PTR(err);
--
2.43.0