[PATCH rdma-next v2] RDMA/mlx5: Add missing error flow in mlx5_ib_set_vport_rep

[PATCH rdma-next v2] RDMA/mlx5: Add missing error flow in mlx5_ib_set_vport_rep

[Edward Srouji]

From: Shay Drory <shayd@nvidia.com>

mlx5_ib_set_vport_rep() attaches the representor netdev to the IB
device, which takes a netdev reference, and then adds the LAG demux
rule. If mlx5_lag_demux_rule_add() fails, the error is returned
without detaching the netdev. The eswitch does not call unload() for a
representor whose load() failed, so the reference is never dropped and
a later unregister_netdevice() of the representor waits forever while
holding the eswitch representors lock.

Add the demux rule before publishing the rep and attaching its netdev,
so a failure there leaves nothing to undo. The rep pointers are still
set before ib_device_set_netdev() sends the netdev attach event, so a
listener never sees the attached port without its rep.

If ib_device_set_netdev() fails, delete the demux rule and clear the
rep pointers. ib_device_set_netdev() cannot fail here, as the port
index is always valid and the port data was allocated when the uplink
rep was loaded, so clearing the pointers does not race with lockless
readers.

Fixes: d6c9b4de8109 ("{net/RDMA}/mlx5: Add LAG demux table API and vport demux rules")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Chiara Meiohas <cmeiohas@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
Changes in v2:
- Add the demux rule before publishing the rep and attaching its netdev,
  instead of clearing the rep pointers when adding it fails, so the error
  path no longer races with lockless readers of the rep pointers (Sashiko).
- Drop the Fixes tag for 8d159eb2117b, as ib_device_set_netdev() cannot
  fail in mlx5_ib_set_vport_rep().
- Rebase on top of rdma for-next.
- Link to v1: https://lore.kernel.org/r/20261015-rep-netdev-leak-v1-1-5110013806ae@nvidia.com
---
 drivers/infiniband/hw/mlx5/ib_rep.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c
index 65d8767d1830c630f5aa2a2a693110e2c9bc9e48..c460018d04754c40677c05a4b603cf8479d2b469 100644
--- a/drivers/infiniband/hw/mlx5/ib_rep.c
+++ b/drivers/infiniband/hw/mlx5/ib_rep.c
@@ -22,21 +22,30 @@ mlx5_ib_set_vport_rep(struct mlx5_core_dev *dev,
 	if (!ibdev)
 		return -EINVAL;
 
+	/* Only Vports that are not native to the LAG master eswitch need to add
+	 * demux rule.
+	 */
+	if (mlx5_eswitch_get_total_vports(dev) <= vport_index) {
+		ret = mlx5_lag_demux_rule_add(rep_dev, rep->vport, vport_index);
+		if (ret)
+			return ret;
+	}
+
 	ibdev->port[vport_index].rep = rep;
 	rep->rep_data[REP_IB].priv = ibdev;
 	ndev = mlx5_ib_get_rep_netdev(rep->esw, rep->vport);
 
 	ret = ib_device_set_netdev(&ibdev->ib_dev, ndev, vport_index + 1);
 	if (ret)
-		return ret;
+		goto err_set_netdev;
 
-	/* Only Vports that are not native to the LAG master eswitch need to add
-	 * demux rule.
-	 */
-	if (mlx5_eswitch_get_total_vports(dev) > vport_index)
-		return 0;
+	return 0;
 
-	return mlx5_lag_demux_rule_add(rep_dev, rep->vport, vport_index);
+err_set_netdev:
+	rep->rep_data[REP_IB].priv = NULL;
+	ibdev->port[vport_index].rep = NULL;
+	mlx5_lag_demux_rule_del(rep_dev, vport_index);
+	return ret;
 }
 
 static void mlx5_ib_register_peer_vport_reps(struct mlx5_core_dev *mdev);

---
base-commit: e50525a486300e5ff8014c9985b8477b2fca0368
change-id: 20261015-rep-netdev-leak-93431d272bbb

Best regards,
-- 
Edward Srouji <edwards@nvidia.com>