[PATCH] mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()

[PATCH] mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()

[Wentao Liang]

When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join()
returns an error without releasing the lag reference obtained by
the earlier mlxsw_sp_lag_get().  All other error paths in the
function jump to the cleanup label that ends with
mlxsw_sp_lag_put(), so this is a single missed release.

Fix the leak by replacing the bare 'return err' with a goto to the
existing error cleanup label, which will drop the reference safely.

Cc: stable@vger.kernel.org
Fixes: 0d65fc13042f ("mlxsw: spectrum: Implement LAG port join/leave")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 3a65420fa1ad..fed708c17332 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4360,7 +4360,7 @@ static int mlxsw_sp_port_lag_join(struct mlxsw_sp_port *mlxsw_sp_port,
 	lag_id = lag->lag_id;
 	err = mlxsw_sp_port_lag_index_get(mlxsw_sp, lag_id, &port_index);
 	if (err)
-		return err;
+		goto err_lag_uppers_bridge_join;
 
 	err = mlxsw_sp_lag_uppers_bridge_join(mlxsw_sp_port, lag_dev,
 					      extack);
-- 
2.34.1

Re: [PATCH] mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()

[Ido Schimmel]

Subject prefix should be "[PATCH net]". See:

https://docs.kernel.org/process/maintainer-netdev.html

On Tue, Jun 09, 2026 at 08:37:09AM +0000, Wentao Liang wrote:
> When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join()
> returns an error without releasing the lag reference obtained by
> the earlier mlxsw_sp_lag_get().  All other error paths in the
> function jump to the cleanup label that ends with
> mlxsw_sp_lag_put(), so this is a single missed release.
> 
> Fix the leak by replacing the bare 'return err' with a goto to the
> existing error cleanup label, which will drop the reference safely.
> 
> Cc: stable@vger.kernel.org
> Fixes: 0d65fc13042f ("mlxsw: spectrum: Implement LAG port join/leave")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

For net:

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

> ---
>  drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
> index 3a65420fa1ad..fed708c17332 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
> @@ -4360,7 +4360,7 @@ static int mlxsw_sp_port_lag_join(struct mlxsw_sp_port *mlxsw_sp_port,
>  	lag_id = lag->lag_id;
>  	err = mlxsw_sp_port_lag_index_get(mlxsw_sp, lag_id, &port_index);
>  	if (err)
> -		return err;
> +		goto err_lag_uppers_bridge_join;

Convention in this code is to create a separate label, but it's not
worth another version

>  
>  	err = mlxsw_sp_lag_uppers_bridge_join(mlxsw_sp_port, lag_dev,
>  					      extack);
> -- 
> 2.34.1
>