BPF Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH v2] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
@ 2020-07-30 10:29 Xin Xiong
  2020-07-30 23:16 ` Jakub Kicinski
  2020-07-30 23:18 ` Saeed Mahameed
  0 siblings, 2 replies; 3+ messages in thread
From: Xin Xiong @ 2020-07-30 10:29 UTC (permalink / raw)
  To: Saeed Mahameed, Leon Romanovsky, David S. Miller, Jakub Kicinski,
	Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
	John Fastabend, Martin KaFai Lau, Song Liu, Yonghong Song,
	Andrii Nakryiko, KP Singh, Tariq Toukan, netdev, linux-rdma,
	linux-kernel, bpf
  Cc: yuanxzhang, Xin Xiong, Xiyu Yang, Xin Tan

The function invokes bpf_prog_inc(), which increases the reference
count of a bpf_prog object "rq->xdp_prog" if the object isn't NULL.

The refcount leak issues take place in two error handling paths. When
either mlx5_wq_ll_create() or mlx5_wq_cyc_create() fails, the function
simply returns the error code and forgets to drop the reference count
increased earlier, causing a reference count leak of "rq->xdp_prog".

Fix this issue by jumping to the error handling path err_rq_wq_destroy
while either function fails.

Fixes: 422d4c401edd ("net/mlx5e: RX, Split WQ objects for different RQ
types")

Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
---
v1 -> v2:
- Amended parts of wording to be better understood
- Added Fixes tag
---
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index a836a02a2116..8e1b1ab416d8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -419,7 +419,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
 		err = mlx5_wq_ll_create(mdev, &rqp->wq, rqc_wq, &rq->mpwqe.wq,
 					&rq->wq_ctrl);
 		if (err)
-			return err;
+			goto err_rq_wq_destroy;
 
 		rq->mpwqe.wq.db = &rq->mpwqe.wq.db[MLX5_RCV_DBR];
 
@@ -470,7 +470,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
 		err = mlx5_wq_cyc_create(mdev, &rqp->wq, rqc_wq, &rq->wqe.wq,
 					 &rq->wq_ctrl);
 		if (err)
-			return err;
+			goto err_rq_wq_destroy;
 
 		rq->wqe.wq.db = &rq->wqe.wq.db[MLX5_RCV_DBR];
 
-- 
2.25.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
  2020-07-30 10:29 [PATCH v2] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq Xin Xiong
@ 2020-07-30 23:16 ` Jakub Kicinski
  2020-07-30 23:18 ` Saeed Mahameed
  1 sibling, 0 replies; 3+ messages in thread
From: Jakub Kicinski @ 2020-07-30 23:16 UTC (permalink / raw)
  To: Xin Xiong
  Cc: Saeed Mahameed, Leon Romanovsky, David S. Miller,
	Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
	John Fastabend, Martin KaFai Lau, Song Liu, Yonghong Song,
	Andrii Nakryiko, KP Singh, Tariq Toukan, netdev, linux-rdma,
	linux-kernel, bpf, yuanxzhang, Xiyu Yang, Xin Tan

On Thu, 30 Jul 2020 18:29:41 +0800 Xin Xiong wrote:
> Fixes: 422d4c401edd ("net/mlx5e: RX, Split WQ objects for different RQ
> types")
> 
> Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>

Thanks for the patch, please make sure Fixes tag is not line-wrapped
and there is no empty line between that and the sign-offs.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
  2020-07-30 10:29 [PATCH v2] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq Xin Xiong
  2020-07-30 23:16 ` Jakub Kicinski
@ 2020-07-30 23:18 ` Saeed Mahameed
  1 sibling, 0 replies; 3+ messages in thread
From: Saeed Mahameed @ 2020-07-30 23:18 UTC (permalink / raw)
  To: songliubraving, hawk, kafai, davem, kpsingh, john.fastabend,
	leon, linux-kernel, ast, linux-rdma, xiongx18, yhs, andriin,
	kuba, daniel, bpf, netdev, Tariq Toukan
  Cc: xiyuyang19, tanxin.ctf, yuanxzhang

On Thu, 2020-07-30 at 18:29 +0800, Xin Xiong wrote:
> The function invokes bpf_prog_inc(), which increases the reference
> count of a bpf_prog object "rq->xdp_prog" if the object isn't NULL.
> 
> The refcount leak issues take place in two error handling paths. When
> either mlx5_wq_ll_create() or mlx5_wq_cyc_create() fails, the
> function
> simply returns the error code and forgets to drop the reference count
> increased earlier, causing a reference count leak of "rq->xdp_prog".
> 
> Fix this issue by jumping to the error handling path
> err_rq_wq_destroy
> while either function fails.
> 
> Fixes: 422d4c401edd ("net/mlx5e: RX, Split WQ objects for different
> RQ
> types")
> 

Please don't break the line of the fixes tag.
I will fix this up.

> Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
> ---
> v1 -> v2:
> - Amended parts of wording to be better understood
> - Added Fixes tag
> ---

Applied to net-mlx5, Thanks !


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-30 10:29 [PATCH v2] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq Xin Xiong
2020-07-30 23:16 ` Jakub Kicinski
2020-07-30 23:18 ` Saeed Mahameed

BPF Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/bpf/0 bpf/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 bpf bpf/ https://lore.kernel.org/bpf \
		bpf@vger.kernel.org
	public-inbox-index bpf

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.bpf


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git