From: Edward Srouji <edwards@nvidia.com>
To: Leon Romanovsky <leon@kernel.org>, Jason Gunthorpe <jgg@ziepe.ca>,
"Tariq Toukan" <tariqt@nvidia.com>,
Mark Bloch <mbloch@nvidia.com>, Shay Drory <shayd@nvidia.com>,
Chiara Meiohas <cmeiohas@nvidia.com>,
Michael Guralnik <michaelgur@nvidia.com>
Cc: <linux-rdma@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
"Edward Srouji" <edwards@nvidia.com>
Subject: [PATCH rdma-next] RDMA/mlx5: Add missing error flow in mlx5_ib_set_vport_rep
Date: Thu, 15 Oct 2026 14:40:38 +0300 [thread overview]
Message-ID: <20261015-rep-netdev-leak-v1-1-5110013806ae@nvidia.com> (raw)
From: Shay Drory <shayd@nvidia.com>
mlx5_ib_set_vport_rep() attaches the representor netdev to the IB
device, which takes a netdev reference, and then adds the LAG demux
rule. If mlx5_lag_demux_rule_add() fails, the error is returned
without detaching the netdev. The eswitch does not call unload() for a
representor whose load() failed, so the reference is never dropped and
a later unregister_netdevice() of the representor waits forever while
holding the eswitch representors lock.
Similarly, if ib_device_set_netdev() fails, the rep pointers assigned at
the start of the function are left dangling.
Undo the netdev attach and clear the rep pointers on failure.
Fixes: d6c9b4de8109 ("{net/RDMA}/mlx5: Add LAG demux table API and vport demux rules")
Fixes: 8d159eb2117b ("RDMA/mlx5: Use IB set_netdev and get_netdev functions")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Chiara Meiohas <cmeiohas@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
drivers/infiniband/hw/mlx5/ib_rep.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c
index 65d8767d1830c630f5aa2a2a693110e2c9bc9e48..9cbd27063ba8ff780446d9be2801012492383734 100644
--- a/drivers/infiniband/hw/mlx5/ib_rep.c
+++ b/drivers/infiniband/hw/mlx5/ib_rep.c
@@ -28,7 +28,7 @@ mlx5_ib_set_vport_rep(struct mlx5_core_dev *dev,
ret = ib_device_set_netdev(&ibdev->ib_dev, ndev, vport_index + 1);
if (ret)
- return ret;
+ goto err_set_netdev;
/* Only Vports that are not native to the LAG master eswitch need to add
* demux rule.
@@ -36,7 +36,18 @@ mlx5_ib_set_vport_rep(struct mlx5_core_dev *dev,
if (mlx5_eswitch_get_total_vports(dev) > vport_index)
return 0;
- return mlx5_lag_demux_rule_add(rep_dev, rep->vport, vport_index);
+ ret = mlx5_lag_demux_rule_add(rep_dev, rep->vport, vport_index);
+ if (ret)
+ goto err_demux;
+
+ return 0;
+
+err_demux:
+ ib_device_set_netdev(&ibdev->ib_dev, NULL, vport_index + 1);
+err_set_netdev:
+ rep->rep_data[REP_IB].priv = NULL;
+ ibdev->port[vport_index].rep = NULL;
+ return ret;
}
static void mlx5_ib_register_peer_vport_reps(struct mlx5_core_dev *mdev);
---
base-commit: 978361dd2ccff357d4fe6aac6ce057d1bfae8312
change-id: 20261015-rep-netdev-leak-93431d272bbb
Best regards,
--
Edward Srouji <edwards@nvidia.com>
next reply other threads:[~2026-10-15 11:41 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-15 11:40 Edward Srouji [this message]
2026-10-15 11:55 ` [PATCH rdma-next] RDMA/mlx5: Add missing error flow in mlx5_ib_set_vport_rep sashiko-bot
2026-10-15 13:36 ` Edward Srouji
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261015-rep-netdev-leak-v1-1-5110013806ae@nvidia.com \
--to=edwards@nvidia.com \
--cc=cmeiohas@nvidia.com \
--cc=jgg@ziepe.ca \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=mbloch@nvidia.com \
--cc=michaelgur@nvidia.com \
--cc=shayd@nvidia.com \
--cc=tariqt@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.