Re: [net,v1,2/3] net/sched: act_gate: fix schedule updates with RCU swap

[Jakub Kicinski <kuba@kernel.org>]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
net/sched: act_gate: fix schedule updates with RCU swap

This patch switches act_gate parameters to an RCU-protected pointer and
uses prepare-then-swap to avoid races during schedule updates.

> diff --git a/net/sched/act_gate.c b/net/sched/act_gate.c
> index c1f75f272757..6934df233df5 100644
> --- a/net/sched/act_gate.c
> +++ b/net/sched/act_gate.c

[ ... ]

> +	if (!list_empty(&newp.entries)) {
> +		list_splice_init(&newp.entries, &p->entries);
> +		p->num_entries = newp.num_entries;
> +	} else if (ret != ACT_P_CREATED) {
> +		struct tcfg_gate_entry *entry, *ne;
> +
> +		list_for_each_entry(entry, &oldp->entries, list) {
> +			ne = kmemdup(entry, sizeof(*ne), GFP_KERNEL);
> +			if (!ne) {
> +				err = -ENOMEM;
> +				goto free_p;
> +			}
> +			INIT_LIST_HEAD(&ne->list);
> +			list_add_tail(&ne->list, &p->entries);
> +		}
> +		p->num_entries = oldp->num_entries;
> +	}

[ ... ]

> +free_p:
> +	kfree(p);

When kmemdup() fails partway through the loop copying entries from
oldp->entries to p->entries, can the entries already added to p->entries
be leaked? The jump to free_p calls kfree(p) but p->entries may contain
allocated entries that are not released first.

The release_entry_list() call at release_new_entries releases newp.entries
rather than p->entries:

> +release_new_entries:
> +	release_entry_list(&newp.entries);

It looks like release_entry_list(&p->entries) should be called before
kfree(p) at the free_p label.