[PATCH] net/mlx5: fix HWS sample action table leak on quit

[Maayan Kashani]

Destroy the composite dest_array mirror action before releasing its
clone destinations. Releasing a JUMP clone can drop the last group
table reference while the dest_array still points at that table,
leaving the firmware flow table objects leaked on port close.

Fixes: 3564e928c759 ("net/mlx5: support HWS flow mirror action")
Cc: stable at dpdk.org

Signed-off-by: Maayan Kashani <mkashani at nvidia.com>
---
 drivers/net/mlx5/mlx5_flow_hw.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 1cffdcc54df..9abd1770a9b 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -14629,10 +14629,18 @@ mlx5_hw_mirror_destroy(struct rte_eth_dev *dev, struct mlx5_mirror *mirror)
 	uint32_t i;
 
 	mlx5_indirect_list_remove_entry(&mirror->indirect);
-	for (i = 0; i < mirror->clones_num; i++)
-		mlx5_mirror_destroy_clone(dev, &mirror->clone[i]);
+	/*
+	 * The mirror action is a composite dest_array that references each
+	 * clone destination (jump table or Rx queue). It must be destroyed
+	 * before the clones so the underlying destinations are no longer
+	 * referenced when they are released; otherwise releasing a clone can
+	 * drop the last reference to a group table and destroy it while the
+	 * dest_array still points at it, leaking the firmware flow table.
+	 */
 	if (mirror->mirror_action)
 		mlx5dr_action_destroy(mirror->mirror_action);
+	for (i = 0; i < mirror->clones_num; i++)
+		mlx5_mirror_destroy_clone(dev, &mirror->clone[i]);
 	mlx5_free(mirror);
 }
 
-- 
2.21.0