nfp: flower: remove merge entry when conntrack offload fails

nfp_ct_do_nft_merge() inserts nft_m_entry into nft_merge_tb and
increments nft_merge_count before calling nfp_fl_ct_add_offload(). If
that call fails, the error path removes the entry from its lists and
frees it, but leaves the hash entry and count behind.

Remove the hash entry and undo the count increment before freeing
nft_m_entry.

Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path
Fixes: a87ceb3d42 ("nfp: flower: offload tc flows of multiple conntrack zones")
Reported-by: Changyul Lee <lcy8047@gmail.com>
Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
Link: https://patch.msgid.link/20261003.final049.214b9988b1e1f0a7@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Sang-Hoon Choi 2026-10-02 19:47:40 +00:00 committed by Jakub Kicinski
parent a089139eb4
commit a032c03527

View File

@ -1260,6 +1260,10 @@ static int nfp_ct_do_nft_merge(struct nfp_fl_ct_zone_entry *zt,
err_nft_ct_offload:
nfp_fl_ct_del_offload(zt->priv->app, nft_m_entry->tc_flower_cookie,
nft_m_entry->netdev);
WARN_ON_ONCE(rhashtable_remove_fast(&zt->nft_merge_tb,
&nft_m_entry->hash_node,
nfp_nft_ct_merge_params));
zt->nft_merge_count--;
err_nft_ct_merge_insert:
list_del(&nft_m_entry->tc_merge_list);
list_del(&nft_m_entry->nft_flow_list);