patch 'net/mlx5: fix IPv6 SRH flex parser initialization' has been queued to stable release 25.11.1

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 03/02/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/81f13ec2ab20ca9d0a7c032d8f7b2d6acb137224

Thanks.

Kevin

---
>From 81f13ec2ab20ca9d0a7c032d8f7b2d6acb137224 Mon Sep 17 00:00:00 2001
From: Gregory Etelson <getelson at nvidia.com>
Date: Thu, 25 Dec 2025 18:20:49 +0200
Subject: [PATCH] net/mlx5: fix IPv6 SRH flex parser initialization

[ upstream commit 1bef69570faf98ea82474dfb02f3d67d5a2d80e1 ]

When multiple threads attempt to create the SRH flex parser
simultaneously, only the first thread (T[0]) can proceed to the
initialization code.
Before doing so, T[0] increases the SRH flex parser reference counter.
Other threads (T[i]) entering the SRH creation function also increase
the reference counter before returning a successful code to their
respective caller functions (CF[i]).

This can lead to three issues:
1. CF[i] may receive a successful return code from the SRH flex parser
creation function before T[0] completes the parser construction.
2. If T[0] fails to create the SRH flex parser, CF[i] will not be
aware and will assume the parser is valid.
3. If T[0] fails, it will not update the SRH flex parser reference
counter.

The patch addresses these issues by locking the SRH flex parser node
creation attempt.

The first thread to enter the locked section will proceed with the
node creation.
If successful, T[0] increases the node reference counter and removes
the lock.
If it fails, T[0] removes the lock and returns an error.

For other threads (T[i]) that obtain the lock, if the flex parser node
reference count is non-zero, the node has already been created.
These threads will then increase the reference counter and return
success.
Otherwise, they will behave like T[0].

Fixes: 00e579166cc0 ("net/mlx5: support IPv6 routing extension matching")

Signed-off-by: Gregory Etelson <getelson at nvidia.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo at nvidia.com>
---
 drivers/net/mlx5/mlx5.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/net/mlx5/mlx5.c b/drivers/net/mlx5/mlx5.c
index 264ad4a0f7..0adfecbfe8 100644
--- a/drivers/net/mlx5/mlx5.c
+++ b/drivers/net/mlx5/mlx5.c
@@ -1056,4 +1056,5 @@ int
 mlx5_alloc_srh_flex_parser(struct rte_eth_dev *dev)
 {
+	static rte_spinlock_t srh_init_sl = RTE_SPINLOCK_INITIALIZER;
 	struct mlx5_devx_graph_node_attr node = {
 		.modify_field_select = 0,
@@ -1073,11 +1074,14 @@ mlx5_alloc_srh_flex_parser(struct rte_eth_dev *dev)
 		return -ENOTSUP;
 	}
-	if (rte_atomic_fetch_add_explicit(&priv->sh->srh_flex_parser.refcnt, 1,
-			rte_memory_order_relaxed) + 1 > 1)
-		return 0;
+	rte_spinlock_lock(&srh_init_sl);
+	if (rte_atomic_load_explicit(&priv->sh->srh_flex_parser.refcnt,
+				     rte_memory_order_relaxed) > 0)
+		goto end;
 	priv->sh->srh_flex_parser.flex.devx_fp = mlx5_malloc(MLX5_MEM_ZERO,
 			sizeof(struct mlx5_flex_parser_devx), 0, SOCKET_ID_ANY);
-	if (!priv->sh->srh_flex_parser.flex.devx_fp)
-		return -ENOMEM;
+	if (!priv->sh->srh_flex_parser.flex.devx_fp) {
+		rte_errno = ENOMEM;
+		goto error;
+	}
 	node.header_length_mode = MLX5_GRAPH_NODE_LEN_FIELD;
 	/* Srv6 first two DW are not counted in. */
@@ -1150,4 +1154,8 @@ mlx5_alloc_srh_flex_parser(struct rte_eth_dev *dev)
 		attr->header_length_mask_width > MLX5_SRH_HEADER_LENGTH_FIELD_SIZE ?
 		MLX5_SRH_HEADER_LENGTH_FIELD_SIZE : attr->header_length_mask_width);
+end:
+	rte_atomic_fetch_add_explicit(&priv->sh->srh_flex_parser.refcnt, 1,
+				      rte_memory_order_relaxed);
+	rte_spinlock_unlock(&srh_init_sl);
 	return 0;
 error:
@@ -1156,4 +1164,5 @@ error:
 	if (priv->sh->srh_flex_parser.flex.devx_fp)
 		mlx5_free(priv->sh->srh_flex_parser.flex.devx_fp);
+	rte_spinlock_unlock(&srh_init_sl);
 	return (rte_errno == 0) ? -ENODEV : -rte_errno;
 }
@@ -1172,5 +1181,5 @@ mlx5_free_srh_flex_parser(struct rte_eth_dev *dev)
 	struct mlx5_internal_flex_parser_profile *fp = &priv->sh->srh_flex_parser;
 
-	if (rte_atomic_fetch_sub_explicit(&fp->refcnt, 1, rte_memory_order_relaxed) - 1)
+	if (rte_atomic_fetch_sub_explicit(&fp->refcnt, 1, rte_memory_order_relaxed) > 1)
 		return;
 	mlx5_devx_cmd_destroy(fp->flex.devx_fp->devx_obj);
-- 
2.53.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-02-26 10:16:51.314914695 +0000
+++ 0109-net-mlx5-fix-IPv6-SRH-flex-parser-initialization.patch	2026-02-26 10:16:47.107459919 +0000
@@ -1 +1 @@
-From 1bef69570faf98ea82474dfb02f3d67d5a2d80e1 Mon Sep 17 00:00:00 2001
+From 81f13ec2ab20ca9d0a7c032d8f7b2d6acb137224 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 1bef69570faf98ea82474dfb02f3d67d5a2d80e1 ]
+
@@ -38 +39,0 @@
-Cc: stable at dpdk.org