From nobody Thu Sep 24 17:04:52 2026 Received: from mail-pj2-f36.google.com (mail-pj2-f36.google.com [74.125.227.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D5013D0907 for ; Tue, 22 Sep 2026 07:42:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.164 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790062973; cv=none; b=gYmacwzKmvC7oqLL+L8r+gwjwUVusATFfr0CWPsVCFV+51FPcUpek14OqfRdRXXG7ns5X0oNUK80HwEGHdQjk8v5fhjSSLDSnIimwGDhOu99gK6rmut7wr1sV5CXw5WF8Yf56rw1leNe2iiqyq2e4t0RgdNCeoXoKHgS5zcmriA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790062973; c=relaxed/simple; bh=6mIcN5UR5Jby1K67kSg7q6vCQLLiQj+bsnPcHyWPHXw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GqfkKH2ILed+fve5fZCG6PCDd5KKM5ORtp+q/wDKMIVcYyVQeDCl8vy1Zx4yEFPMUwkenm8e5YWQLnH/MN5N9+26BAJ1SZvIBg4+UJPNO2aTyqFe26l2EgRUqNPmuyU5rkT6X9zKIkLokXaJzBCW+6HbWBNG98SuYj/R9BL1zao= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=newp8E6P; arc=none smtp.client-ip=74.125.227.164 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="newp8E6P" Received: by mail-pj2-f36.google.com with SMTP id d9443c01a7336-2d8fdc579daso42710715ad.1 for ; Tue, 22 Sep 2026 00:42:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790062972; x=1790667772; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=T4bXv4ioTNcgEst1EUu0msleevfYTOmr0PXPd7ZaOJ4=; b=newp8E6PQSiBq7JbvDujX7GXrvi4EgGUlvyIx9af2uRw077RSCpH9XzOnxRRHsPfGx 0R8VK+a6ZuxjvTIHJmapSDY+KAz3AMR15gNYjDEhHxp6Mq6BfMRUEK2eEn27ZpDx+5IO Ls7W6xessLJw1MSxxQb4u+qKxr+luopUJOOk5tSCCHO8DtB6yg6Cv+rbTpmAkJgrtG9K yvB55fMoOxOjBNE1ADMVK5MrWxB/ATQqvccOVX4DkUZrewOtdPMAmOuTWDYMZWHAx9fp MhEUbr/+1fA1u8Wiq0wady8H+j0cZV6AtX3bfDQ8syeda3qVCJNBzhcUVMB4uHa4ntVl GhWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790062972; x=1790667772; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=T4bXv4ioTNcgEst1EUu0msleevfYTOmr0PXPd7ZaOJ4=; b=MpWZfHdAPBUVxDniV4fcDej2jG8QhNJQdS7h/CLp5kpHrySv+Nwx7MDnM8DkBTor6W 1iDiEFXSrJ8rrOwEFJF1nt2jK60GsNQ+lIg2IjOOhZZAIzifJJ6noqziExVbP3pcMjaJ q95Oty6BRy9Hc0JqdqGZUvKjaXMvjH2luMGaXN10oTuQ3+QBjkRtSKnFnB6lmwveGqRT tNpxeBoq934MFLWw71PfNAnsBbApz0odK7AI1wn4dQJEX74FiY+sKb1ZZeKR3PTPgbtP nCdUWAnFOaXjEhguigiXpqAq09WXj6oS08r/Y5Q0Ca3CncmcLjDQI2FAOEqHARNbPkqJ 0mzQ== X-Forwarded-Encrypted: i=1; AKwUvBw2D/V2Y68Q/B6fgaEtgPZJ6ZQXy2O3hWHgwIlFOGK5T/xzI6UkUJOn5YU7aon8/i0slPN5XAOTzgsdOoY=@vger.kernel.org X-Gm-Message-State: AFuF++lk5+3NnS4Fcm+gWuUnISk1Q/rz2o2ZqkJ8duk4meqlKUzUaA5N 9q9zfpJzUUXC/prBoeyXUQxCm4CNF3HKHY3sbey9HcDbAPAVcNvP1QGhs/QWjPhTqR/iQg== X-Gm-Gg: AYBFou3h51NKxZ5XurlZM7qBkT7l6ID7OPHe/t7dTq70dlsjlh7Ty8u5bbG7eY5zmqI 5hMXCf9UW25aoLh1mVU914bOm1nk6fQ6z3xVcMQO+O0dtLa+G0YPZ+p4yG0XamvRJaLcnO/37+A ZxnDd1bzWpR8qcWkwZkM3qUsGjqsRaxYjYCMofFmtmmpWJ7jy9pQ+8WKT3C36po/u8kTX2gUBuF 0xwHgwVzpdxp+iPSp0noB1bhflnxdCpM60sW5Rla36ipqQzzs5+GnVfMA2Msiv6vIDGh8DZ4YSh vHWjFJddRxFaFWrKsl3dSHL4jYYmc6vaLjS0RrYTst+OdwYfs0rUG8NeBTMq+2UwEK0to+KXfy/ HB6T5yz7if9eERb4d7FX4PfPp+CIl011xMFdAsoEEyU9Y+C3p8/h7L80Qz3d+GEtqXoebfQXZCp yNIVtF5AnRzfT9fXpZj3/ojQ+9vt2zcqGE2eRniKInL4gi+MGj4NsWcltJ443yCcosQ8y1MTE2P sZJk95NobjUX3NZXmadzLYNDgjheJkEFIyhxQuCem2BxKS6TdnVQMHw X-Received: by 2002:a17:903:2f48:b0:2dd:c100:3131 with SMTP id d9443c01a7336-2df60b4cdc6mr3361165ad.45.1790062971717; Tue, 22 Sep 2026 00:42:51 -0700 (PDT) Received: from localhost.localdomain (5.240.104.34.bc.googleusercontent.com. [34.104.240.5]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2df5d05602csm5215005ad.65.2026.09.22.00.42.49 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 22 Sep 2026 00:42:51 -0700 (PDT) From: Ginger Li To: saeedm@nvidia.com, leon@kernel.org, tariqt@nvidia.com, mbloch@nvidia.com Cc: netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net] net/mlx5: HV VHCA: Fix the agent registration race Date: Tue, 22 Sep 2026 15:42:46 +0800 Message-ID: <20260922074246.20411-1-ginger.jzllee@gmail.com> X-Mailer: git-send-email 2.46.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mlx5_hv_vhca_agent_create() drops agents_lock between checking whether an agent is already registered for the type and publishing the new agent, so t= wo concurrent create calls for the same type can both pass the check. The sec= ond one then silently replaces the first one in hv_vhca->agents[], and the agent allocated by the first call is leaked. Hold agents_lock for the whole registration. While at it, read hv_vhca->agents[MLX5_HV_VHCA_AGENT_CONTROL] under the lock in mlx5_hv_vhca_cleanup() as well, since that slot is written under the lock. Fixes: 87175120defd ("net/mlx5: Add HV VHCA infrastructure") Signed-off-by: Ginger Li --- drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c b/driver= s/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c @@ -228,7 +228,10 @@ void mlx5_hv_vhca_cleanup(struct mlx5_hv_vhca *hv_vhca if (!hv_vhca) return; =20 + mutex_lock(&hv_vhca->agents_lock); agent =3D hv_vhca->agents[MLX5_HV_VHCA_AGENT_CONTROL]; + mutex_unlock(&hv_vhca->agents_lock); + if (agent) mlx5_hv_vhca_control_agent_destroy(agent); =20 @@ -270,11 +273,12 @@ mlx5_hv_vhca_agent_create(struct mlx5_hv_vhca *hv_vhca mutex_unlock(&hv_vhca->agents_lock); return ERR_PTR(-EINVAL); } - mutex_unlock(&hv_vhca->agents_lock); =20 agent =3D kzalloc_obj(*agent); - if (!agent) + if (!agent) { + mutex_unlock(&hv_vhca->agents_lock); return ERR_PTR(-ENOMEM); + } =20 agent->type =3D type; agent->hv_vhca =3D hv_vhca; @@ -286,7 +290,6 @@ mlx5_hv_vhca_agent_create(struct mlx5_hv_vhca *hv_vhca if (ctx_update) WRITE_ONCE(*ctx_update, agent); =20 - mutex_lock(&hv_vhca->agents_lock); hv_vhca->agents[type] =3D agent; mutex_unlock(&hv_vhca->agents_lock); =20 --=20 2.43.0