Re: [BUG] devlink: region trigger leaks a permanent snapshot id slot on every successful auto-id capture

[Jacob Keller <jacob.e.keller@intel.com>]

On 10/26/2026 9:29 AM, Fernando Fernandez Mancera wrote:
> On 10/25/26 5:27 AM, Guikun Yang wrote:
>> Hi Jiri, Jacob,
>>
>> devlink_nl_cmd_region_trigger() (net/devlink/region.c) allocates a
>> snapshot id via __devlink_region_snapshot_id_get() when the request
>> does not carry DEVLINK_ATTR_REGION_SNAPSHOT_ID, then creates the
>> snapshot.  On the success path it returns without ever releasing the
>> caller's reference, so the id's refcount stays at 2 instead of dropping
>> to the snapshot-only 1.
>>
>> __devlink_region_snapshot_id_get() is documented as:
>>
>>   *    Note that the caller of this function counts as a 'user', in
>> order to
>>   *    avoid race conditions.  The caller must release its hold on the
>>   *    snapshot by using devlink_region_snapshot_id_put.
>>
>> The netlink trigger is its own caller, and nothing in the kernel holds
>> the id after the command returns, so the hold is never released.
>>
>> Consequences, per successful auto-id trigger:
>>
>>    xa_alloc(&devlink->snapshot_ids, id, xa_mk_value(1))   /* count = 1 */
>>    __devlink_region_snapshot_create()                     /* count = 2 */
>>    ... success, no put ...
>>
>> Later, when the snapshot is deleted, devlink_region_snapshot_del()
>> calls __devlink_snapshot_id_decrement(), bringing the count to 1.
>> Since it is not zero, the id is NOT erased from the xarray:
>>
>>   *    If the count reaches zero, erase this id from the xarray,
>> freeing it
>>   *    up for future re-use by devlink_region_snapshot_id_get().
>>
>> The slot stays occupied forever.  Every subsequent attempt to use that
>> particular id fails:
>>
>>    - __devlink_snapshot_id_insert() rejects it with -EEXIST (xa_load()
>>      finds the stale entry), so a user can never explicitly re-create a
>>      snapshot with that id;
>>    - reading or deleting "the snapshot with that id" returns -ENOENT,
>>      so there is also no way to clean the stale entry up.
>>

Oof. Good find.

> 
> Yes, this is right. I am sending a patch. I reproduced it on netdevsim
> and Intel E825-C with ice driver.
> 
> Not sure if it is worth writing a selftest, might consider it as a
> follow-up.
> 
> Thanks,
> Fernando.
> 
Thanks for working on a fix.

-Jake