Regression with 5dcd8400884c ("macsec: missing dev_put() on error in macsec_newlink()")

Regression with 5dcd8400884c ("macsec: missing dev_put() on error in macsec_newlink()")

[Laura Abbott]

[-- Attachment #1: Type: text/plain, Size: 819 bytes --]

Hi,

Fedora got a bug report of a regression when trying to remove the
the macsec module (https://bugzilla.redhat.com/show_bug.cgi?id=1566410).
I did a bisect and found

commit 5dcd8400884cc4a043a6d4617e042489e5d566a9
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Wed Mar 21 11:09:01 2018 +0300

     macsec: missing dev_put() on error in macsec_newlink()
     
     We moved the dev_hold(real_dev); call earlier in the function but forgot
     to update the error paths.
     
     Fixes: 0759e552bce7 ("macsec: fix negative refcnt on parent link")
     Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
     Signed-off-by: David S. Miller <davem@davemloft.net>

The script I used for testing based on the reporter is attached. It
looks like modprobe is stuck in the D state. Any idea?

Thanks,
Laura

[-- Attachment #2: mac-sec-setup.sh --]
[-- Type: application/x-shellscript, Size: 2123 bytes --]

Re: Regression with 5dcd8400884c ("macsec: missing dev_put() on error in macsec_newlink()")

[Sabrina Dubroca]

Hello Laura,

2018-04-14, 10:56:55 -0700, Laura Abbott wrote:
> Hi,
> 
> Fedora got a bug report of a regression when trying to remove the
> the macsec module (https://bugzilla.redhat.com/show_bug.cgi?id=1566410).
> I did a bisect and found
> 
> commit 5dcd8400884cc4a043a6d4617e042489e5d566a9
> Author: Dan Carpenter <dan.carpenter@oracle.com>
> Date:   Wed Mar 21 11:09:01 2018 +0300
> 
>     macsec: missing dev_put() on error in macsec_newlink()
>     We moved the dev_hold(real_dev); call earlier in the function but forgot
>     to update the error paths.
>     Fixes: 0759e552bce7 ("macsec: fix negative refcnt on parent link")
>     Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>     Signed-off-by: David S. Miller <davem@davemloft.net>
> 
> The script I used for testing based on the reporter is attached. It
> looks like modprobe is stuck in the D state. Any idea?

I don't think that reference was actually leaked. It gets released in
macsec_free_netdev() when the device is deleted.

modprobe getting stuck is just a side-effect of the refcount going
negative on the parent device, since removing the module needs to take
the lock that is held by device deletion.

I'll send a revert tomorrow.

Thanks for the report,

-- 
Sabrina

[PATCH net] Revert "macsec: missing dev_put() on error in macsec_newlink()"

[Dan Carpenter]

This patch is just wrong, sorry.  I was trying to fix a static checker
warning and misread the code.  The reference taken in macsec_newlink()
is released in macsec_free_netdev() when the netdevice is destroyed.

This reverts commit 5dcd8400884cc4a043a6d4617e042489e5d566a9.

Reported-by: Laura Abbott <labbott@redhat.com>
Fixes: 5dcd8400884c ("macsec: missing dev_put() on error in macsec_newlink()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sabrina Dubroca <sd@queasysnail.net>
---
I sent this earlier but I messed up the CC list.  I've updated the
commit message as well.

 drivers/net/macsec.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 9cbb0c8a896a..7de88b33d5b9 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -3277,7 +3277,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
 	err = netdev_upper_dev_link(real_dev, dev, extack);
 	if (err < 0)
-		goto put_dev;
+		goto unregister;
 
 	/* need to be already registered so that ->init has run and
 	 * the MAC addr is set
@@ -3316,8 +3316,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 	macsec_del_dev(macsec);
 unlink:
 	netdev_upper_dev_unlink(real_dev, dev);
-put_dev:
-	dev_put(real_dev);
+unregister:
 	unregister_netdevice(dev);
 	return err;
 }
-- 
2.16.2

Re: [PATCH net] Revert "macsec: missing dev_put() on error in macsec_newlink()"

[David Miller]

From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 16 Apr 2018 13:17:50 +0300

> This patch is just wrong, sorry.  I was trying to fix a static checker
> warning and misread the code.  The reference taken in macsec_newlink()
> is released in macsec_free_netdev() when the netdevice is destroyed.
> 
> This reverts commit 5dcd8400884cc4a043a6d4617e042489e5d566a9.
> 
> Reported-by: Laura Abbott <labbott@redhat.com>
> Fixes: 5dcd8400884c ("macsec: missing dev_put() on error in macsec_newlink()")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Acked-by: Sabrina Dubroca <sd@queasysnail.net>
> ---
> I sent this earlier but I messed up the CC list.  I've updated the
> commit message as well.

Applied, thanks Dan.