Re: [BUG] devlink: region trigger leaks a permanent snapshot id slot on every successful auto-id capture

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 10/25/26 5:27 AM, Guikun Yang wrote:
> Hi Jiri, Jacob,
> 
> devlink_nl_cmd_region_trigger() (net/devlink/region.c) allocates a
> snapshot id via __devlink_region_snapshot_id_get() when the request
> does not carry DEVLINK_ATTR_REGION_SNAPSHOT_ID, then creates the
> snapshot.  On the success path it returns without ever releasing the
> caller's reference, so the id's refcount stays at 2 instead of dropping
> to the snapshot-only 1.
> 
> __devlink_region_snapshot_id_get() is documented as:
> 
>   *	Note that the caller of this function counts as a 'user', in order to
>   *	avoid race conditions.  The caller must release its hold on the
>   *	snapshot by using devlink_region_snapshot_id_put.
> 
> The netlink trigger is its own caller, and nothing in the kernel holds
> the id after the command returns, so the hold is never released.
> 
> Consequences, per successful auto-id trigger:
> 
>    xa_alloc(&devlink->snapshot_ids, id, xa_mk_value(1))   /* count = 1 */
>    __devlink_region_snapshot_create()                     /* count = 2 */
>    ... success, no put ...
> 
> Later, when the snapshot is deleted, devlink_region_snapshot_del()
> calls __devlink_snapshot_id_decrement(), bringing the count to 1.
> Since it is not zero, the id is NOT erased from the xarray:
> 
>   *	If the count reaches zero, erase this id from the xarray, freeing it
>   *	up for future re-use by devlink_region_snapshot_id_get().
> 
> The slot stays occupied forever.  Every subsequent attempt to use that
> particular id fails:
> 
>    - __devlink_snapshot_id_insert() rejects it with -EEXIST (xa_load()
>      finds the stale entry), so a user can never explicitly re-create a
>      snapshot with that id;
>    - reading or deleting "the snapshot with that id" returns -ENOENT,
>      so there is also no way to clean the stale entry up.
> 

Yes, this is right. I am sending a patch. I reproduced it on netdevsim 
and Intel E825-C with ice driver.

Not sure if it is worth writing a selftest, might consider it as a 
follow-up.

Thanks,
Fernando.