[PATCH] net/mlx5: fix panic for non template age rules flush

[Maayan Kashani]

When a user creates a non-template rule with both age and counter actions,
both actions share the same counter.
If a flow flush occurs, the rule is destroyed and the counter is released.
However, the age sampling callback may still access the age/counter during
the free, leading to a panic on assertion in debug mode.

This creates a race condition: one thread samples the age while another
releases the age/counter info used by the age action.
The fix is to ignore this case where the age is
free and counter not freed yet,
or the counter was freed during the age check.

Fixes: 04a4de756e14 ("net/mlx5: support flow age action with HWS")
Cc: stable at dpdk.org

Signed-off-by: Maayan Kashani <mkashani at nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski at nvidia.com>
---
 drivers/net/mlx5/mlx5_hws_cnt.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_hws_cnt.c b/drivers/net/mlx5/mlx5_hws_cnt.c
index fce7a7e815f..5c738f38caf 100644
--- a/drivers/net/mlx5/mlx5_hws_cnt.c
+++ b/drivers/net/mlx5/mlx5_hws_cnt.c
@@ -170,10 +170,13 @@ mlx5_hws_aging_check(struct mlx5_priv *priv, struct mlx5_hws_cnt_pool *cpool)
 			break;
 		case HWS_AGE_FREE:
 			/*
-			 * AGE parameter with state "FREE" couldn't be pointed
-			 * by any counter since counter is destroyed first.
-			 * Fall-through.
+			 * Since this check is async, we may reach a race condition
+			 * where the age and counter are used in the same rule,
+			 * using the same counter index,
+			 * age was freed first, and counter was not freed yet.
+			 * Aging check can be safely ignored in that case.
 			 */
+			continue;
 		default:
 			MLX5_ASSERT(0);
 			continue;
-- 
2.21.0