[PATCH net-next] net: ethtool: fix leaking netdev ref if ethnl_default_parse() failed

[PATCH net-next] net: ethtool: fix leaking netdev ref if ethnl_default_parse() failed

[Jakub Kicinski]

Ido spotted that I made a mistake in commit under Fixes,
ethnl_default_parse() may acquire a dev reference even when it returns
an error. This may have been driven by the code structure in dumps
(which unconditionally release dev before handling errors), but it's
too much of a trap. Functions should undo what they did before returning
an error, rather than expecting caller to clean up.

Rather than fixing ethnl_default_set_doit() directly make
ethnl_default_parse() clean up errors.

Reported-by: Ido Schimmel <idosch@idosch.org>
Link: https://lore.kernel.org/aGEPszpq9eojNF4Y@shredder
Fixes: 963781bdfe20 ("net: ethtool: call .parse_request for SET handlers")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 net/ethtool/netlink.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c
index 09c81cc9a08f..b1f8999c1adc 100644
--- a/net/ethtool/netlink.c
+++ b/net/ethtool/netlink.c
@@ -455,10 +455,15 @@ static int ethnl_default_parse(struct ethnl_req_info *req_info,
 	if (request_ops->parse_request) {
 		ret = request_ops->parse_request(req_info, tb, info->extack);
 		if (ret < 0)
-			return ret;
+			goto err_dev;
 	}
 
 	return 0;
+
+err_dev:
+	netdev_put(req_info->dev, &req_info->dev_tracker);
+	req_info->dev = NULL;
+	return ret;
 }
 
 /**
@@ -508,7 +513,7 @@ static int ethnl_default_doit(struct sk_buff *skb, struct genl_info *info)
 
 	ret = ethnl_default_parse(req_info, info, ops, !ops->allow_nodev_do);
 	if (ret < 0)
-		goto err_dev;
+		goto err_free;
 	ethnl_init_reply_data(reply_data, ops, req_info->dev);
 
 	rtnl_lock();
@@ -554,6 +559,7 @@ static int ethnl_default_doit(struct sk_buff *skb, struct genl_info *info)
 		ops->cleanup_data(reply_data);
 err_dev:
 	netdev_put(req_info->dev, &req_info->dev_tracker);
+err_free:
 	kfree(reply_data);
 	kfree(req_info);
 	return ret;
@@ -656,6 +662,8 @@ static int ethnl_default_start(struct netlink_callback *cb)
 	}
 
 	ret = ethnl_default_parse(req_info, &info->info, ops, false);
+	if (ret < 0)
+		goto free_reply_data;
 	if (req_info->dev) {
 		/* We ignore device specification in dump requests but as the
 		 * same parser as for non-dump (doit) requests is used, it
@@ -664,8 +672,6 @@ static int ethnl_default_start(struct netlink_callback *cb)
 		netdev_put(req_info->dev, &req_info->dev_tracker);
 		req_info->dev = NULL;
 	}
-	if (ret < 0)
-		goto free_reply_data;
 
 	ctx->ops = ops;
 	ctx->req_info = req_info;
@@ -714,13 +720,13 @@ static int ethnl_perphy_start(struct netlink_callback *cb)
 	 * the dev's ifindex, .dumpit() will grab and release the netdev itself.
 	 */
 	ret = ethnl_default_parse(req_info, &info->info, ops, false);
+	if (ret < 0)
+		goto free_reply_data;
 	if (req_info->dev) {
 		phy_ctx->ifindex = req_info->dev->ifindex;
 		netdev_put(req_info->dev, &req_info->dev_tracker);
 		req_info->dev = NULL;
 	}
-	if (ret < 0)
-		goto free_reply_data;
 
 	ctx->ops = ops;
 	ctx->req_info = req_info;
-- 
2.50.0

Re: [PATCH net-next] net: ethtool: fix leaking netdev ref if ethnl_default_parse() failed

[Ido Schimmel]

On Mon, Jun 30, 2025 at 08:40:53AM -0700, Jakub Kicinski wrote:
> Ido spotted that I made a mistake in commit under Fixes,
> ethnl_default_parse() may acquire a dev reference even when it returns
> an error. This may have been driven by the code structure in dumps
> (which unconditionally release dev before handling errors), but it's
> too much of a trap. Functions should undo what they did before returning
> an error, rather than expecting caller to clean up.
> 
> Rather than fixing ethnl_default_set_doit() directly make
> ethnl_default_parse() clean up errors.
> 
> Reported-by: Ido Schimmel <idosch@idosch.org>
> Link: https://lore.kernel.org/aGEPszpq9eojNF4Y@shredder
> Fixes: 963781bdfe20 ("net: ethtool: call .parse_request for SET handlers")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Thanks!

Re: [PATCH net-next] net: ethtool: fix leaking netdev ref if ethnl_default_parse() failed

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 30 Jun 2025 08:40:53 -0700 you wrote:
> Ido spotted that I made a mistake in commit under Fixes,
> ethnl_default_parse() may acquire a dev reference even when it returns
> an error. This may have been driven by the code structure in dumps
> (which unconditionally release dev before handling errors), but it's
> too much of a trap. Functions should undo what they did before returning
> an error, rather than expecting caller to clean up.
> 
> [...]

Here is the summary with links:
  - [net-next] net: ethtool: fix leaking netdev ref if ethnl_default_parse() failed
    https://git.kernel.org/netdev/net-next/c/3249eae7e445

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html