* [PATCH net-next v2] octeontx2-af: Fix PCI device reference leaks in debugfs
@ 2026-06-08 16:55 Yuho Choi
2026-06-10 15:35 ` Jakub Kicinski
0 siblings, 1 reply; 3+ messages in thread
From: Yuho Choi @ 2026-06-08 16:55 UTC (permalink / raw)
To: Sunil Goutham, Linu Cherian, Geetha sowjanya, hariprasad,
Subbaraya Sundeep, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni
Cc: netdev, linux-kernel, Yuho Choi
cgx_print_stats(), cgx_print_dmac_flt(), and cgx_print_fwdata()
look up the RVU AF device with pci_get_device() and pass the returned
pointer directly to pci_get_drvdata(). pci_get_device() returns a PCI
device with an elevated reference count, so the lookup reference is
leaked on every debugfs read.
Store the returned PCI device pointer, check it before reading driver
data, and release the lookup reference after pci_get_drvdata(). In
cgx_print_dmac_flt(), release the AF lookup reference before reusing
pdev for pci_get_domain_bus_and_slot().
Fixes: f967488d095e ("octeontx2-af: Add per CGX port level NIX Rx/Tx counters")
Fixes: dbc52debf95f ("octeontx2-af: Debugfs support for DMAC filters")
Fixes: 49f02e6877d1 ("Octeontx2-af: Debugfs support for firmware data")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
Changes in v2:
- Keep using the local RVU AF pdev returned by pci_get_device() instead
of cgx->pdev, because cgx->pdev belongs to the CGX/RPM device.
- Rebase on current net-next so netdev CI can apply the patch.
.../marvell/octeontx2/af/rvu_debugfs.c | 31 +++++++++++++++----
1 file changed, 25 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index fa461489acdd..04ba091773b6 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -2838,9 +2838,16 @@ static int cgx_print_stats(struct seq_file *s, int lmac_id)
int stat = 0, err = 0;
u64 tx_stat, rx_stat;
struct rvu *rvu;
+ struct pci_dev *pdev = NULL;
+
+ pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
+ PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
+ if (!pdev)
+ return -ENODEV;
+
+ rvu = pci_get_drvdata(pdev);
+ pci_dev_put(pdev);
- rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
- PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
if (!rvu)
return -ENODEV;
@@ -2958,8 +2965,13 @@ static int cgx_print_dmac_flt(struct seq_file *s, int lmac_id)
u64 cfg, mac;
int pf;
- rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
- PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
+ pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
+ PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
+ if (!pdev)
+ return -ENODEV;
+
+ rvu = pci_get_drvdata(pdev);
+ pci_dev_put(pdev);
if (!rvu)
return -ENODEV;
@@ -3014,9 +3026,16 @@ static int cgx_print_fwdata(struct seq_file *s, int lmac_id)
struct phy_s *phy;
struct rvu *rvu;
int cgx_id, i;
+ struct pci_dev *pdev = NULL;
+
+ pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
+ PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
+ if (!pdev)
+ return -ENODEV;
+
+ rvu = pci_get_drvdata(pdev);
+ pci_dev_put(pdev);
- rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
- PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
if (!rvu)
return -ENODEV;
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net-next v2] octeontx2-af: Fix PCI device reference leaks in debugfs
2026-06-08 16:55 [PATCH net-next v2] octeontx2-af: Fix PCI device reference leaks in debugfs Yuho Choi
@ 2026-06-10 15:35 ` Jakub Kicinski
2026-06-11 2:21 ` Ratheesh Kannoth
0 siblings, 1 reply; 3+ messages in thread
From: Jakub Kicinski @ 2026-06-10 15:35 UTC (permalink / raw)
To: Yuho Choi
Cc: Sunil Goutham, Linu Cherian, Geetha sowjanya, hariprasad,
Subbaraya Sundeep, Andrew Lunn, David S . Miller, Eric Dumazet,
Paolo Abeni, netdev, linux-kernel, nshettyj, Ratheesh Kannoth
On Mon, 8 Jun 2026 12:55:46 -0400 Yuho Choi wrote:
> cgx_print_stats(), cgx_print_dmac_flt(), and cgx_print_fwdata()
> look up the RVU AF device with pci_get_device() and pass the returned
> pointer directly to pci_get_drvdata(). pci_get_device() returns a PCI
> device with an elevated reference count, so the lookup reference is
> leaked on every debugfs read.
>
> Store the returned PCI device pointer, check it before reading driver
> data, and release the lookup reference after pci_get_drvdata(). In
> cgx_print_dmac_flt(), release the AF lookup reference before reusing
> pdev for pci_get_domain_bus_and_slot().
>
> Fixes: f967488d095e ("octeontx2-af: Add per CGX port level NIX Rx/Tx counters")
> Fixes: dbc52debf95f ("octeontx2-af: Debugfs support for DMAC filters")
> Fixes: 49f02e6877d1 ("Octeontx2-af: Debugfs support for firmware data")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Marvell, please review patches from external contributors promptly.
Review question sort of based on a Sashiko comment - this is part of
the rvu device driver, AFAIU, does anything prevent the AF from getting
removed (via sysfs for instance) while this code is using its priv?
> Changes in v2:
> - Keep using the local RVU AF pdev returned by pci_get_device() instead
> of cgx->pdev, because cgx->pdev belongs to the CGX/RPM device.
> - Rebase on current net-next so netdev CI can apply the patch.
> .../marvell/octeontx2/af/rvu_debugfs.c | 31 +++++++++++++++----
> 1 file changed, 25 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
> index fa461489acdd..04ba091773b6 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
> @@ -2838,9 +2838,16 @@ static int cgx_print_stats(struct seq_file *s, int lmac_id)
> int stat = 0, err = 0;
> u64 tx_stat, rx_stat;
> struct rvu *rvu;
> + struct pci_dev *pdev = NULL;
> +
> + pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
> + PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
> + if (!pdev)
> + return -ENODEV;
> +
> + rvu = pci_get_drvdata(pdev);
> + pci_dev_put(pdev);
>
> - rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
> - PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
> if (!rvu)
> return -ENODEV;
>
> @@ -2958,8 +2965,13 @@ static int cgx_print_dmac_flt(struct seq_file *s, int lmac_id)
> u64 cfg, mac;
> int pf;
>
> - rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
> - PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
> + pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
> + PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
> + if (!pdev)
> + return -ENODEV;
> +
> + rvu = pci_get_drvdata(pdev);
> + pci_dev_put(pdev);
> if (!rvu)
> return -ENODEV;
>
> @@ -3014,9 +3026,16 @@ static int cgx_print_fwdata(struct seq_file *s, int lmac_id)
> struct phy_s *phy;
> struct rvu *rvu;
> int cgx_id, i;
> + struct pci_dev *pdev = NULL;
> +
> + pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
> + PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
> + if (!pdev)
> + return -ENODEV;
> +
> + rvu = pci_get_drvdata(pdev);
> + pci_dev_put(pdev);
>
> - rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
> - PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
> if (!rvu)
> return -ENODEV;
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net-next v2] octeontx2-af: Fix PCI device reference leaks in debugfs
2026-06-10 15:35 ` Jakub Kicinski
@ 2026-06-11 2:21 ` Ratheesh Kannoth
0 siblings, 0 replies; 3+ messages in thread
From: Ratheesh Kannoth @ 2026-06-11 2:21 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Yuho Choi, Sunil Goutham, Linu Cherian, Geetha sowjanya,
hariprasad, Subbaraya Sundeep, Andrew Lunn, David S . Miller,
Eric Dumazet, Paolo Abeni, netdev, linux-kernel, nshettyj
On 2026-06-10 at 21:05:44, Jakub Kicinski (kuba@kernel.org) wrote:
> On Mon, 8 Jun 2026 12:55:46 -0400 Yuho Choi wrote:
> > cgx_print_stats(), cgx_print_dmac_flt(), and cgx_print_fwdata()
> > look up the RVU AF device with pci_get_device() and pass the returned
> > pointer directly to pci_get_drvdata(). pci_get_device() returns a PCI
> > device with an elevated reference count, so the lookup reference is
> > leaked on every debugfs read.
> >
> > Store the returned PCI device pointer, check it before reading driver
> > data, and release the lookup reference after pci_get_drvdata(). In
> > cgx_print_dmac_flt(), release the AF lookup reference before reusing
> > pdev for pci_get_domain_bus_and_slot().
> >
> > Fixes: f967488d095e ("octeontx2-af: Add per CGX port level NIX Rx/Tx counters")
> > Fixes: dbc52debf95f ("octeontx2-af: Debugfs support for DMAC filters")
> > Fixes: 49f02e6877d1 ("Octeontx2-af: Debugfs support for firmware data")
> > Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
>
> Marvell, please review patches from external contributors promptly.
>
> Review question sort of based on a Sashiko comment - this is part of
> the rvu device driver, AFAIU, does anything prevent the AF from getting
> removed (via sysfs for instance) while this code is using its priv?
RVU AF driver's teardown sequence prevents the race here. In
rvu_remove(), the very first call is rvu_dbg_exit(rvu),
which calls debugfs_remove_recursive() on the debugfs root.
ASFAIK, debugfs_remove_recursive() will block until all active
readers (i.e., any in-progress seq_file read callbacks like
cgx_print_stats(), cgx_print_dmac_flt(), and
cgx_print_fwdata()) have completed before the removal
proceeds. Only after rvu_dbg_exit() returns does
rvu_remove() proceed to free the rvu structure.
A better approach would be to pass the rvu object(rvu structure has pdev field) while
creating the debugfs file itself, e.g.:
RVU_DEBUG_SEQ_FOPS(cgx_dmac_flt, cgx_dmac_flt_display, s/NULL/rvu);
This would eliminate the pci_get_device() lookup entirely. We
will post this as a code clean-up patch to net-next.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-11 2:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-08 16:55 [PATCH net-next v2] octeontx2-af: Fix PCI device reference leaks in debugfs Yuho Choi
2026-06-10 15:35 ` Jakub Kicinski
2026-06-11 2:21 ` Ratheesh Kannoth
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.