[PATCH] net/bnxt: fix HA timer spinlock leak

Manish Kurup manish.kurup at broadcom.com
Tue Oct 6 01:50:49 CEST 2026


From: Joey Zhong <xiaozhen.zhong at broadcom.com>

ulp_ha_mgr_timer_cb() acquires the global ULP context spinlock via
bnxt_ulp_cntxt_entry_acquire(). When myclient_cnt is transiently 0,
the function did a bare return without calling
bnxt_ulp_cntxt_entry_release(), leaking the lock and deadlocking all
subsequent flow operations on the device.

Replace the bare return with goto cb_restart, matching every other
error path in the callback: it releases the lock and restarts the
timer. Since a zero client count is transient, restarting the timer
is the correct behavior, so the misleading "kill timer" log message
is updated accordingly.

Fixes: 1993b267dbcb ("net/bnxt: cleanup ULP parser and mapper")
Cc: stable at dpdk.org

Signed-off-by: Joey Zhong <xiaozhen.zhong at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c b/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
index 7b7c10d360..d558f78c8c 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_ha_mgr.c
@@ -256,8 +256,8 @@ ulp_ha_mgr_timer_cb(void *arg)
 	myclient_cnt = bnxt_ulp_cntxt_num_shared_clients_get(ulp_ctx);
 	if (myclient_cnt == 0) {
 		BNXT_DRV_DBG(ERR,
-			     "PANIC Client Count is zero kill timer\n.");
-		return;
+			     "Client Count is zero, skip and restart timer.\n");
+		goto cb_restart;
 	}
 
 	tfp = bnxt_ulp_cntxt_tfp_get(ulp_ctx, BNXT_ULP_SESSION_TYPE_SHARED_WC);
-- 
2.31.1



More information about the dev mailing list