Centos-kernel-stream-9

mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00

Files

T

History

Petr Oros a68fd37006 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

JIRA: https://issues.redhat.com/browse/RHEL-121722

Upstream commit(s):
commit f94c1a114ac209977bdf5ca841b98424295ab1f0
Author: Shay Drory <shayd@nvidia.com>
Date:   Mon Nov 17 14:05:49 2025 +0200

    devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

    The function devl_rate_nodes_destroy is documented to "Unset parent for
    all rate objects". However, it was only calling the driver-specific
    `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing
    the parent's refcount, without actually setting the
    `devlink_rate->parent` pointer to NULL.

    This leaves a dangling pointer in the `devlink_rate` struct, which cause
    refcount error in netdevsim[1] and mlx5[2]. In addition, this is
    inconsistent with the behavior of `devlink_nl_rate_parent_node_set`,
    where the parent pointer is correctly cleared.

    This patch fixes the issue by explicitly setting `devlink_rate->parent`
    to NULL after notifying the driver, thus fulfilling the function's
    documented behavior for all rate objects.

    [1]
    repro steps:
    echo 1 > /sys/bus/netdevsim/new_device
    devlink dev eswitch set netdevsim/netdevsim1 mode switchdev
    echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs
    devlink port function rate add netdevsim/netdevsim1/test_node
    devlink port function rate set netdevsim/netdevsim1/128 parent test_node
    echo 1 > /sys/bus/netdevsim/del_device

    dmesg:
    refcount_t: decrement hit 0; leaking memory.
    WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0
    CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
    RIP: 0010:refcount_warn_saturate+0x42/0xe0
    Call Trace:
     <TASK>
     devl_rate_leaf_destroy+0x8d/0x90
     __nsim_dev_port_del+0x6c/0x70 [netdevsim]
     nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]
     nsim_drv_remove+0x2b/0xb0 [netdevsim]
     device_release_driver_internal+0x194/0x1f0
     bus_remove_device+0xc6/0x130
     device_del+0x159/0x3c0
     device_unregister+0x1a/0x60
     del_device_store+0x111/0x170 [netdevsim]
     kernfs_fop_write_iter+0x12e/0x1e0
     vfs_write+0x215/0x3d0
     ksys_write+0x5f/0xd0
     do_syscall_64+0x55/0x10f0
     entry_SYSCALL_64_after_hwframe+0x4b/0x53

    [2]
    devlink dev eswitch set pci/0000:08:00.0 mode switchdev
    devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000
    devlink port function rate add pci/0000:08:00.0/group1
    devlink port function rate set pci/0000:08:00.0/32768 parent group1
    modprobe -r mlx5_ib mlx5_fwctl mlx5_core

    dmesg:
    refcount_t: decrement hit 0; leaking memory.
    WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0
    CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
    RIP: 0010:refcount_warn_saturate+0x42/0xe0
    Call Trace:
     <TASK>
     devl_rate_leaf_destroy+0x8d/0x90
     mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core]
     mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core]
     mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core]
     mlx5_sf_esw_event+0xc4/0x120 [mlx5_core]
     notifier_call_chain+0x33/0xa0
     blocking_notifier_call_chain+0x3b/0x50
     mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core]
     mlx5_eswitch_disable+0x63/0x90 [mlx5_core]
     mlx5_unload+0x1d/0x170 [mlx5_core]
     mlx5_uninit_one+0xa2/0x130 [mlx5_core]
     remove_one+0x78/0xd0 [mlx5_core]
     pci_device_remove+0x39/0xa0
     device_release_driver_internal+0x194/0x1f0
     unbind_store+0x99/0xa0
     kernfs_fop_write_iter+0x12e/0x1e0
     vfs_write+0x215/0x3d0
     ksys_write+0x5f/0xd0
     do_syscall_64+0x53/0x1f0
     entry_SYSCALL_64_after_hwframe+0x4b/0x53

    Fixes: d755598450 ("devlink: Allow setting parent node of rate objects")
    Signed-off-by: Shay Drory <shayd@nvidia.com>
    Reviewed-by: Carolina Jubran <cjubran@nvidia.com>
    Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
    Link: https://patch.msgid.link/1763381149-1234377-1-git-send-email-tariqt@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Petr Oros <poros@redhat.com>