Re: [PATCH net-next v6 02/13] net: mana: share the EQ pool across a queue-set swap

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] net: mana: leak of DMA region handle in mana_gd_create_mana_eq() error path
--

commit 1d0366c5b44b66d602e9a488b5674896e64e1285
Author: Long Li <longli@microsoft.com>
net: mana: share the EQ pool across a queue-set swap

This commit makes the EQ pool port-owned so that overlapping queue sets
can share EQs instead of requiring allocations of new vectors. It
allocates max_queues slots and tracks populated entries, growing the
pool before creating replacement CQs.

> diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
> --- a/drivers/net/ethernet/microsoft/mana/mana_en.c
> +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c

[ ... ]

> +/* Grow the shared EQ pool without replacing live entries. */
> +static int mana_grow_eqs(struct mana_port_context *apc, unsigned int need)
> +{

[ ... ]

> +	for (i = apc->num_eqs; i < need; i++) {
> +		msi = (i + 1) % gc->num_msix_usable;
> +
> +		gic = mana_gd_get_gic(gc, !gc->msi_sharing, &msi);
> +		if (IS_ERR(gic)) {
> +			err = PTR_ERR(gic);
> +			goto out;
> +		}
> +		spec.eq.msix_index = msi;
> +
> +		err = mana_gd_create_mana_eq(gd, &spec, &apc->eqs[i].eq);

[Severity: Medium]
Does this code leak the DMA region handle when queue creation fails? 

The new mana_grow_eqs() function iteratively loops and relies on
mana_gd_create_mana_eq(), but looking at the error path inside
mana_gd_create_mana_eq():

mana_gd_create_mana_eq() {
    ...
    err = mana_gd_create_dma_region(gd, gmi);
    if (err)
        goto out;
    ...
    err = mana_gd_create_eq(gd, spec, true, queue);
    if (err)
        goto out;
    ...
out:
    dev_err(gc->dev, "Failed to create queue type %d of size: %u, err: %d\n",
            spec->type, spec->queue_size, err);
    mana_gd_free_memory(gmi);
free_q:
    kfree(queue);
    return err;
}

If mana_gd_create_eq() fails, execution jumps to the out label, which
calls mana_gd_free_memory() and kfree() but entirely omits calling
mana_gd_destroy_dma_region() for the successfully allocated DMA region.
Since mana_gd_destroy_eq() does not destroy the DMA region either, the
handle mapping remains persistently leaked.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1790795005.git.weh@linux.microsoft.com?part=2