net/mlx5: fix memory management for released offloaded tunnels.

PMD tunnel offload object can be referenced by application tunnel_decap_set or tunnel_match commands, when these commands request private tunnel items or actions and flow rules related to that tunnel. PMD keeps tunnel offload object as long as there is an active reference to that tunnel.
PMD releases tunnel offload object after the last reference resumes.

The patch removes tunnel offload object from search database before it's memory released.

---
 drivers/net/mlx5/mlx5_flow.c | 1 +
 1 file changed, 1 insertion(+)

index 642516ad4b..52ade39a42 100644
@@ -7423,6 +7423,7 @@ mlx5_flow_tunnel_free(struct rte_eth_dev *dev,
 
 	DRV_LOG(DEBUG, "port %u release pmd tunnel id=0x%x",
 		dev->data->port_id, tunnel->tunnel_id);
+	LIST_REMOVE(tunnel, chain);
 	mlx5_hlist_destroy(tunnel->groups);
 	ipool = priv->sh->ipool[MLX5_IPOOL_TUNNEL_ID];
 	mlx5_ipool_free(ipool, tunnel->tunnel_id);

2.29.2

PMD did not remove tunnel offload object from tunnels database before it released the object memory. As the result, the tunnels database become corrupted and subsequent search operations triggered PMD crash. The patch removes tunnel offload object from the tunnels database when the object is not in-use by PMD any more.

---
 drivers/net/mlx5/mlx5_flow.c | 1 +
 1 file changed, 1 insertion(+)

index 642516ad4b..52ade39a42 100644
@@ -7423,6 +7423,7 @@ mlx5_flow_tunnel_free(struct rte_eth_dev *dev,
 
 	DRV_LOG(DEBUG, "port %u release pmd tunnel id=0x%x",
 		dev->data->port_id, tunnel->tunnel_id);
+	LIST_REMOVE(tunnel, chain);
 	mlx5_hlist_destroy(tunnel->groups);
 	ipool = priv->sh->ipool[MLX5_IPOOL_TUNNEL_ID];
 	mlx5_ipool_free(ipool, tunnel->tunnel_id);

2.29.2

25/11/2020 10:44, Gregory Etelson:

Applied, thanks