Linux RDMA and InfiniBand development
 help / color / mirror / Atom feed
From: Edward Srouji <edwards@nvidia.com>
To: Leon Romanovsky <leon@kernel.org>, Jason Gunthorpe <jgg@ziepe.ca>,
	"Tariq Toukan" <tariqt@nvidia.com>,
	Mark Bloch <mbloch@nvidia.com>, Shay Drory <shayd@nvidia.com>,
	Chiara Meiohas <cmeiohas@nvidia.com>,
	Michael Guralnik <michaelgur@nvidia.com>
Cc: <linux-rdma@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	"Edward Srouji" <edwards@nvidia.com>
Subject: [PATCH rdma-next] RDMA/mlx5: Add missing error flow in mlx5_ib_set_vport_rep
Date: Thu, 15 Oct 2026 14:40:38 +0300	[thread overview]
Message-ID: <20261015-rep-netdev-leak-v1-1-5110013806ae@nvidia.com> (raw)

From: Shay Drory <shayd@nvidia.com>

mlx5_ib_set_vport_rep() attaches the representor netdev to the IB
device, which takes a netdev reference, and then adds the LAG demux
rule. If mlx5_lag_demux_rule_add() fails, the error is returned
without detaching the netdev. The eswitch does not call unload() for a
representor whose load() failed, so the reference is never dropped and
a later unregister_netdevice() of the representor waits forever while
holding the eswitch representors lock.

Similarly, if ib_device_set_netdev() fails, the rep pointers assigned at
the start of the function are left dangling.

Undo the netdev attach and clear the rep pointers on failure.

Fixes: d6c9b4de8109 ("{net/RDMA}/mlx5: Add LAG demux table API and vport demux rules")
Fixes: 8d159eb2117b ("RDMA/mlx5: Use IB set_netdev and get_netdev functions")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Chiara Meiohas <cmeiohas@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
 drivers/infiniband/hw/mlx5/ib_rep.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c
index 65d8767d1830c630f5aa2a2a693110e2c9bc9e48..9cbd27063ba8ff780446d9be2801012492383734 100644
--- a/drivers/infiniband/hw/mlx5/ib_rep.c
+++ b/drivers/infiniband/hw/mlx5/ib_rep.c
@@ -28,7 +28,7 @@ mlx5_ib_set_vport_rep(struct mlx5_core_dev *dev,
 
 	ret = ib_device_set_netdev(&ibdev->ib_dev, ndev, vport_index + 1);
 	if (ret)
-		return ret;
+		goto err_set_netdev;
 
 	/* Only Vports that are not native to the LAG master eswitch need to add
 	 * demux rule.
@@ -36,7 +36,18 @@ mlx5_ib_set_vport_rep(struct mlx5_core_dev *dev,
 	if (mlx5_eswitch_get_total_vports(dev) > vport_index)
 		return 0;
 
-	return mlx5_lag_demux_rule_add(rep_dev, rep->vport, vport_index);
+	ret = mlx5_lag_demux_rule_add(rep_dev, rep->vport, vport_index);
+	if (ret)
+		goto err_demux;
+
+	return 0;
+
+err_demux:
+	ib_device_set_netdev(&ibdev->ib_dev, NULL, vport_index + 1);
+err_set_netdev:
+	rep->rep_data[REP_IB].priv = NULL;
+	ibdev->port[vport_index].rep = NULL;
+	return ret;
 }
 
 static void mlx5_ib_register_peer_vport_reps(struct mlx5_core_dev *mdev);

---
base-commit: 978361dd2ccff357d4fe6aac6ce057d1bfae8312
change-id: 20261015-rep-netdev-leak-93431d272bbb

Best regards,
-- 
Edward Srouji <edwards@nvidia.com>


             reply	other threads:[~2026-10-15 11:41 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-15 11:40 Edward Srouji [this message]
2026-10-15 11:55 ` [PATCH rdma-next] RDMA/mlx5: Add missing error flow in mlx5_ib_set_vport_rep sashiko-bot
2026-10-15 13:36   ` Edward Srouji

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261015-rep-netdev-leak-v1-1-5110013806ae@nvidia.com \
    --to=edwards@nvidia.com \
    --cc=cmeiohas@nvidia.com \
    --cc=jgg@ziepe.ca \
    --cc=leon@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-rdma@vger.kernel.org \
    --cc=mbloch@nvidia.com \
    --cc=michaelgur@nvidia.com \
    --cc=shayd@nvidia.com \
    --cc=tariqt@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox