From: Wenjia Zhang <wenjia@linux.ibm.com>
To: Wen Gu <guwen@linux.alibaba.com>,
jaka@linux.ibm.com, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com
Cc: alibuda@linux.alibaba.com, tonylu@linux.alibaba.com,
linux-s390@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH net] net/smc: fix netdev refcnt leak in smc_ib_find_route()
Date: Tue, 7 May 2024 07:26:32 +0200 [thread overview]
Message-ID: <80aba643-60a0-4a1c-b90a-de6e0d8d7bc1@linux.ibm.com> (raw)
In-Reply-To: <20240506015439.108739-1-guwen@linux.alibaba.com>
On 06.05.24 03:54, Wen Gu wrote:
> A netdev refcnt leak issue was found when unregistering netdev after
> using SMC. It can be reproduced as follows.
>
> - run tests based on SMC.
> - unregister the net device.
>
> The following error message can be observed.
>
> 'unregister_netdevice: waiting for ethx to become free. Usage count = x'
>
> With CONFIG_NET_DEV_REFCNT_TRACKER set, more detailed error message can
> be provided by refcount tracker:
>
> unregister_netdevice: waiting for eth1 to become free. Usage count = 2
> ref_tracker: eth%d@ffff9cabc3bf8548 has 1/1 users at
> ___neigh_create+0x8e/0x420
> neigh_event_ns+0x52/0xc0
> arp_process+0x7c0/0x860
> __netif_receive_skb_list_core+0x258/0x2c0
> __netif_receive_skb_list+0xea/0x150
> netif_receive_skb_list_internal+0xf2/0x1b0
> napi_complete_done+0x73/0x1b0
> mlx5e_napi_poll+0x161/0x5e0 [mlx5_core]
> __napi_poll+0x2c/0x1c0
> net_rx_action+0x2a7/0x380
> __do_softirq+0xcd/0x2a7
>
> It is because in smc_ib_find_route(), neigh_lookup() takes a netdev
> refcnt but does not release. So fix it.
>
> Fixes: e5c4744cfb59 ("net/smc: add SMC-Rv2 connection establishment")
> Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
> ---
> net/smc/smc_ib.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
> index 97704a9e84c7..b431bd8a5172 100644
> --- a/net/smc/smc_ib.c
> +++ b/net/smc/smc_ib.c
> @@ -210,10 +210,11 @@ int smc_ib_find_route(struct net *net, __be32 saddr, __be32 daddr,
> goto out;
> if (rt->rt_uses_gateway && rt->rt_gw_family != AF_INET)
> goto out;
> - neigh = rt->dst.ops->neigh_lookup(&rt->dst, NULL, &fl4.daddr);
> + neigh = dst_neigh_lookup(&rt->dst, &fl4.daddr);
> if (neigh) {
> memcpy(nexthop_mac, neigh->ha, ETH_ALEN);
> *uses_gateway = rt->rt_uses_gateway;
> + neigh_release(neigh);
> return 0;
> }
> out:
Hi Wen,
Thanks for fixing that! It looks good to me and works well.
Please release rt for that condition in the next version. (Thx, @Ratheesh!)
Thanks,
Wenjia
prev parent reply other threads:[~2024-05-07 5:48 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-06 1:54 [PATCH net] net/smc: fix netdev refcnt leak in smc_ib_find_route() Wen Gu
2024-05-06 2:27 ` David Wei
2024-05-06 5:51 ` Ratheesh Kannoth
2024-05-06 7:16 ` Wen Gu
2024-05-07 5:26 ` Wenjia Zhang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=80aba643-60a0-4a1c-b90a-de6e0d8d7bc1@linux.ibm.com \
--to=wenjia@linux.ibm.com \
--cc=alibuda@linux.alibaba.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=guwen@linux.alibaba.com \
--cc=jaka@linux.ibm.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=tonylu@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).