netdev - Re: [rdma/siw] unregister_netdevice: waiting for bond0 to become free. Usage count = 3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <8f90fba8-60b9-46e2-8990-45311c7b1540@I-love.SAKURA.ne.jp>
Date: Fri, 5 Dec 2025 23:20:11 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Bernard Metzler <bernard.metzler@...ux.dev>,
        OFED mailing list <linux-rdma@...r.kernel.org>,
        Network Development <netdev@...r.kernel.org>
Subject: Re: [rdma/siw] unregister_netdevice: waiting for bond0 to become
 free. Usage count = 3

On 2025/11/25 23:31, Tetsuo Handa wrote:
> The output from the debug printk() patch is attached (because it has 2500 lines).
> You can see that there is one alloc_gid_entry() call in bond0[74] but there is
> no corresponding put_gid_ndev() call. I suspect that there is a refcount leak in
> "struct ib_gid_table_entry" handling. Where should we check next?

Another debug printk() patch in next-20251204 reported that there is a refcount
leak in "struct ib_gid_table_entry" handling.

Is serialization between creating a new ib_gid_table_entry and deleting existing
ib_gid_table_entry properly implemented (like a similar case explained in
https://lkml.kernel.org/r/85b701a9-511d-4cf2-8c9c-5fade945f187@I-love.SAKURA.ne.jp ) ?
Don't we need to check ndev->reg_state when creating a new ib_gid_table_entry (like
https://lkml.kernel.org/r/b9653191-d479-4c8b-8536-1326d028db5c@I-love.SAKURA.ne.jp does) ?

Regards.



unregister_netdevice: waiting for ������ to become free. Usage count = 3
ref_tracker: netdev@...f88805e01c628 has 1/1 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4415 [inline]
     netdev_hold include/linux/netdevice.h:4444 [inline]
     ib_device_set_netdev+0x2e1/0x6d0 drivers/infiniband/core/device.c:2253
     rxe_register_device+0x1bb/0x350 drivers/infiniband/sw/rxe/rxe_verbs.c:1552
     rxe_net_add+0x81/0x110 drivers/infiniband/sw/rxe/rxe_net.c:586
     rxe_newlink+0xdd/0x190 drivers/infiniband/sw/rxe/rxe.c:234
     nldev_newlink+0x4a5/0x5a0 drivers/infiniband/core/nldev.c:1797
     rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
     rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
     rdma_nl_rcv+0x6ae/0x980 drivers/infiniband/core/netlink.c:259
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:728
     __sock_sendmsg net/socket.c:743 [inline]
     ____sys_sendmsg+0x577/0x880 net/socket.c:2601
     ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2655
     __sys_sendmsg net/socket.c:2687 [inline]
     __do_sys_sendmsg net/socket.c:2692 [inline]
     __se_sys_sendmsg net/socket.c:2690 [inline]
     __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2690
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

Call trace for ������@ffff8880254b5f00 +1 at
     alloc_gid_entry drivers/infiniband/core/cache.c:410 [inline]
     add_modify_gid+0x317/0xcc0 drivers/infiniband/core/cache.c:550
     __ib_cache_gid_add+0x230/0x370 drivers/infiniband/core/cache.c:681
     ib_cache_gid_set_default_gid+0x5f9/0x710 drivers/infiniband/core/cache.c:960
     add_default_gids drivers/infiniband/core/roce_gid_mgmt.c:469 [inline]
     enum_all_gids_of_dev_cb+0x17d/0x270 drivers/infiniband/core/roce_gid_mgmt.c:495
     ib_enum_roce_netdev+0x1ab/0x2e0 drivers/infiniband/core/device.c:2419
     gid_table_setup_one drivers/infiniband/core/cache.c:1033 [inline]
     ib_cache_setup_one+0x428/0x5e0 drivers/infiniband/core/cache.c:1711
     ib_register_device+0xfbe/0x1400 drivers/infiniband/core/device.c:1454
     rxe_register_device+0x1e3/0x350 drivers/infiniband/sw/rxe/rxe_verbs.c:1556
     rxe_net_add+0x81/0x110 drivers/infiniband/sw/rxe/rxe_net.c:586
     rxe_newlink+0xdd/0x190 drivers/infiniband/sw/rxe/rxe.c:234
     nldev_newlink+0x4a5/0x5a0 drivers/infiniband/core/nldev.c:1797
     rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
     rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
     rdma_nl_rcv+0x6ae/0x980 drivers/infiniband/core/netlink.c:259
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:728
Call trace for ������@ffff8880254b5f00 +4 at
     get_gid_entry drivers/infiniband/core/cache.c:435 [inline]
     rdma_get_gid_attr+0x2ee/0x3f0 drivers/infiniband/core/cache.c:1300
     smc_ib_fill_mac net/smc/smc_ib.c:160 [inline]
     smc_ib_remember_port_attr net/smc/smc_ib.c:369 [inline]
     smc_ib_port_event_work+0x196/0x940 net/smc/smc_ib.c:388
     process_one_work+0x93a/0x15a0 kernel/workqueue.c:3261
Call trace for ������@ffff8880254b5f00 -4 at
     put_gid_entry drivers/infiniband/core/cache.c:441 [inline]
     rdma_put_gid_attr+0x7c/0x130 drivers/infiniband/core/cache.c:1381
     smc_ib_fill_mac net/smc/smc_ib.c:165 [inline]
     smc_ib_remember_port_attr net/smc/smc_ib.c:369 [inline]
     smc_ib_port_event_work+0x1d4/0x940 net/smc/smc_ib.c:388
     process_one_work+0x93a/0x15a0 kernel/workqueue.c:3261
balance for ������@ib_gid_table_entry is 1