[PATCH] net/mlx5: fix HWS sample action table leak on quit

[Bing Zhao]

Hi,

> -----Original Message-----
> From: Maayan Kashani <mkashani at nvidia.com>
> Sent: Sunday, August 16, 2026 4:15 PM
> To: dev at dpdk.org
> Cc: Maayan Kashani <mkashani at nvidia.com>; Raslan Darawsheh
> <rasland at nvidia.com>; stable at dpdk.org; Dariusz Sosnowski
> <dsosnowski at nvidia.com>; Slava Ovsiienko <viacheslavo at nvidia.com>; Bing
> Zhao <bingz at nvidia.com>; Ori Kam <orika at nvidia.com>; Suanming Mou
> <suanmingm at nvidia.com>; Matan Azrad <matan at nvidia.com>; Gregory Etelson
> <getelson at nvidia.com>
> Subject: [PATCH] net/mlx5: fix HWS sample action table leak on quit
> 
> Destroy the composite dest_array mirror action before releasing its clone
> destinations. Releasing a JUMP clone can drop the last group table
> reference while the dest_array still points at that table, leaving the
> firmware flow table objects leaked on port close.
> 
> Fixes: 3564e928c759 ("net/mlx5: support HWS flow mirror action")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Maayan Kashani <mkashani at nvidia.com>
> ---
>  drivers/net/mlx5/mlx5_flow_hw.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow_hw.c
> b/drivers/net/mlx5/mlx5_flow_hw.c index 1cffdcc54df..9abd1770a9b 100644
> --- a/drivers/net/mlx5/mlx5_flow_hw.c
> +++ b/drivers/net/mlx5/mlx5_flow_hw.c
> @@ -14629,10 +14629,18 @@ mlx5_hw_mirror_destroy(struct rte_eth_dev *dev,
> struct mlx5_mirror *mirror)
>  	uint32_t i;
> 
>  	mlx5_indirect_list_remove_entry(&mirror->indirect);
> -	for (i = 0; i < mirror->clones_num; i++)
> -		mlx5_mirror_destroy_clone(dev, &mirror->clone[i]);
> +	/*
> +	 * The mirror action is a composite dest_array that references each
> +	 * clone destination (jump table or Rx queue). It must be destroyed
> +	 * before the clones so the underlying destinations are no longer
> +	 * referenced when they are released; otherwise releasing a clone
> can
> +	 * drop the last reference to a group table and destroy it while the
> +	 * dest_array still points at it, leaking the firmware flow table.
> +	 */
>  	if (mirror->mirror_action)
>  		mlx5dr_action_destroy(mirror->mirror_action);
> +	for (i = 0; i < mirror->clones_num; i++)
> +		mlx5_mirror_destroy_clone(dev, &mirror->clone[i]);
>  	mlx5_free(mirror);
>  }
> 
> --
> 2.21.0

Acked-by: Bing Zhao <bingz at nvidia.com>