Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/steering/hws): A matcher that fails to disconnect is reinserted

Impact

A matcher that fails to disconnect is reinserted into the shared hardware-steering matcher list and then freed by the caller, leaving a dangling entry in state that serves every tenant's offloaded flow rules on that NIC. The result is a use-after-free and node crash, and before the crash the steering graph can be left mis-wired so packets are evaluated against the wrong rule set.

Who can reach it

The HWS matcher list is shared state sitting behind tenant-visible flow offload - the tc/OVS rules programmed for VF representors on behalf of tenant VMs. Triggering the bad path requires a firmware command failure during matcher disconnect, which sustained rule churn or steering-resource exhaustion from a tenant can provoke. Requires mlx5 hardware steering with switchdev/eswitch offload enabled. Not reachable directly from the fabric.

What to do

Boot a kernel carrying the HWS disconnect error-flow fix (stable commits below; no fixed-version list published for this ID). Interim controls: cap the number of offloaded flow rules per tenant representor, and prefer software steering (DMFS/SMFS) over HWS on nodes where tenants drive rule installation.

References