From: Saeed Mahameed <saeedm@nvidia.com>
To: Roi Dayan <roid@nvidia.com>,
"dan.carpenter@oracle.com" <dan.carpenter@oracle.com>,
Feras Daoud <ferasda@nvidia.com>
Cc: "linux-rdma@vger.kernel.org" <linux-rdma@vger.kernel.org>
Subject: Re: [bug report] net/mxl5e: Add change profile method
Date: Wed, 10 Feb 2021 06:12:58 +0000 [thread overview]
Message-ID: <82d9b9b7b0b063aaab358041906baf3ac48ec4a9.camel@nvidia.com> (raw)
In-Reply-To: <YBz2CSKUBlUCRxsZ@mwanda>
On Fri, 2021-02-05 at 15:45 +0300, Dan Carpenter wrote:
> Hello Saeed Mahameed and Feras Daoud,
>
Hi Dan, thanks for the report, adding Roi the owner of this change.
> I'm not exactly sure if I should blame commit c4d7eb57687f:
> "net/mxl5e:
> Add change profile method" fomr Mar 22, 2020 or commit 182570b26223
> ("net/mlx5e: Gather common netdev init/cleanup functionality in one
> place") from Oct 2, 2018.
>
> drivers/net/ethernet/mellanox/mlx5/core/en_main.c:5658
> mlx5e_netdev_change_profile() warn: 'priv->htb.qos_sq_stats' double
> freed
> drivers/net/ethernet/mellanox/mlx5/core/en_main.c:5658
> mlx5e_netdev_change_profile() warn: 'priv->scratchpad.cpumask' double
> freed
> drivers/net/ethernet/mellanox/mlx5/core/en_main.c:5789 mlx5e_probe()
> warn: 'priv->htb.qos_sq_stats' double freed
> drivers/net/ethernet/mellanox/mlx5/core/en_main.c:5789 mlx5e_probe()
> warn: 'priv->scratchpad.cpumask' double freed
> drivers/net/ethernet/mellanox/mlx5/core/en_main.c:5802 mlx5e_remove()
> warn: 'priv->htb.qos_sq_stats' double freed
> drivers/net/ethernet/mellanox/mlx5/core/en_main.c:5802 mlx5e_remove()
> warn: 'priv->scratchpad.cpumask' double freed
> drivers/net/ethernet/mellanox/mlx5/core/en_rep.c:1317
> mlx5e_vport_rep_unload() warn: 'priv->htb.qos_sq_stats' double freed
> drivers/net/ethernet/mellanox/mlx5/core/en_rep.c:1317
> mlx5e_vport_rep_unload() warn: 'priv->scratchpad.cpumask' double
> freed
If I may ask,
What is this report ? Coverity ? static checker ? or runtime checks ?
>
> drivers/net/ethernet/mellanox/mlx5/core/en_main.c
> 5639 int mlx5e_netdev_change_profile(struct mlx5e_priv *priv,
> 5640 const struct mlx5e_profile
> *new_profile, void *new_ppriv)
> 5641 {
> 5642 unsigned int new_max_nch = mlx5e_calc_max_nch(priv,
> new_profile);
> 5643 const struct mlx5e_profile *orig_profile = priv-
> >profile;
> 5644 void *orig_ppriv = priv->ppriv;
> 5645 int err, rollback_err;
> 5646
> 5647 /* sanity */
> 5648 if (new_max_nch != priv->max_nch) {
> 5649 netdev_warn(priv->netdev,
> 5650 "%s: Replacing profile with
> different max channles\n",
> 5651 __func__);
> 5652 return -EINVAL;
> 5653 }
> 5654
> 5655 /* cleanup old profile */
> 5656 mlx5e_detach_netdev(priv);
> 5657 priv->profile->cleanup(priv);
>
> The problem is that mlx5i_pkey_cleanup() calls mlx5e_priv_cleanup().
>
> 5658 mlx5e_priv_cleanup(priv);
> ^^^^^^^^^^^^^^^^^^^^^^^^
> And then it gets called again here.
impossible, mlx5i would never call mlx5e_netdev_change_profile, but
anyway i see the issue with the error flow if this function fail after
mlx5e_priv_cleanup, then we remove the driver, we will actually end up
with double free, since this function is not supposed to free priv-
>fields and then just abort..
this function must guarantee that the priv is still intact after it
returns. We will handle.
next prev parent reply other threads:[~2021-02-10 6:20 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-05 12:45 [bug report] net/mxl5e: Add change profile method Dan Carpenter
2021-02-10 6:12 ` Saeed Mahameed [this message]
2021-02-10 7:02 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=82d9b9b7b0b063aaab358041906baf3ac48ec4a9.camel@nvidia.com \
--to=saeedm@nvidia.com \
--cc=dan.carpenter@oracle.com \
--cc=ferasda@nvidia.com \
--cc=linux-rdma@vger.kernel.org \
--cc=roid@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox