From: Edward Srouji <edwards@nvidia.com>
To: Leon Romanovsky <leon@kernel.org>, Jason Gunthorpe <jgg@ziepe.ca>,
"Tariq Toukan" <tariqt@nvidia.com>,
Mark Bloch <mbloch@nvidia.com>, Shay Drory <shayd@nvidia.com>,
Chiara Meiohas <cmeiohas@nvidia.com>,
Michael Guralnik <michaelgur@nvidia.com>
Cc: <linux-rdma@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
"Edward Srouji" <edwards@nvidia.com>
Subject: [PATCH rdma-next] RDMA/mlx5: Add missing error flow in mlx5_ib_set_vport_rep
Date: Thu, 15 Oct 2026 14:40:38 +0300 [thread overview]
Message-ID: <20261015-rep-netdev-leak-v1-1-5110013806ae@nvidia.com> (raw)
From: Shay Drory <shayd@nvidia.com>
mlx5_ib_set_vport_rep() attaches the representor netdev to the IB
device, which takes a netdev reference, and then adds the LAG demux
rule. If mlx5_lag_demux_rule_add() fails, the error is returned
without detaching the netdev. The eswitch does not call unload() for a
representor whose load() failed, so the reference is never dropped and
a later unregister_netdevice() of the representor waits forever while
holding the eswitch representors lock.
Similarly, if ib_device_set_netdev() fails, the rep pointers assigned at
the start of the function are left dangling.
Undo the netdev attach and clear the rep pointers on failure.
Fixes: d6c9b4de8109 ("{net/RDMA}/mlx5: Add LAG demux table API and vport demux rules")
Fixes: 8d159eb2117b ("RDMA/mlx5: Use IB set_netdev and get_netdev functions")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Chiara Meiohas <cmeiohas@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
drivers/infiniband/hw/mlx5/ib_rep.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c
index 65d8767d1830c630f5aa2a2a693110e2c9bc9e48..9cbd27063ba8ff780446d9be2801012492383734 100644
--- a/drivers/infiniband/hw/mlx5/ib_rep.c
+++ b/drivers/infiniband/hw/mlx5/ib_rep.c
@@ -28,7 +28,7 @@ mlx5_ib_set_vport_rep(struct mlx5_core_dev *dev,
ret = ib_device_set_netdev(&ibdev->ib_dev, ndev, vport_index + 1);
if (ret)
- return ret;
+ goto err_set_netdev;
/* Only Vports that are not native to the LAG master eswitch need to add
* demux rule.
@@ -36,7 +36,18 @@ mlx5_ib_set_vport_rep(struct mlx5_core_dev *dev,
if (mlx5_eswitch_get_total_vports(dev) > vport_index)
return 0;
- return mlx5_lag_demux_rule_add(rep_dev, rep->vport, vport_index);
+ ret = mlx5_lag_demux_rule_add(rep_dev, rep->vport, vport_index);
+ if (ret)
+ goto err_demux;
+
+ return 0;
+
+err_demux:
+ ib_device_set_netdev(&ibdev->ib_dev, NULL, vport_index + 1);
+err_set_netdev:
+ rep->rep_data[REP_IB].priv = NULL;
+ ibdev->port[vport_index].rep = NULL;
+ return ret;
}
static void mlx5_ib_register_peer_vport_reps(struct mlx5_core_dev *mdev);
---
base-commit: 978361dd2ccff357d4fe6aac6ce057d1bfae8312
change-id: 20261015-rep-netdev-leak-93431d272bbb
Best regards,
--
Edward Srouji <edwards@nvidia.com>
next reply other threads:[~2026-10-15 11:41 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-15 11:40 Edward Srouji [this message]
2026-10-15 11:55 ` [PATCH rdma-next] RDMA/mlx5: Add missing error flow in mlx5_ib_set_vport_rep sashiko-bot
2026-10-15 13:36 ` Edward Srouji
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261015-rep-netdev-leak-v1-1-5110013806ae@nvidia.com \
--to=edwards@nvidia.com \
--cc=cmeiohas@nvidia.com \
--cc=jgg@ziepe.ca \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=mbloch@nvidia.com \
--cc=michaelgur@nvidia.com \
--cc=shayd@nvidia.com \
--cc=tariqt@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox