netdev - Re: [net-next,7/9] mlx5: psp: implement deferred tx key deletion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260207043212.4129693-1-kuba@kernel.org>
Date: Fri,  6 Feb 2026 20:32:12 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: daniel.zahka@...il.com
Cc: Jakub Kicinski <kuba@...nel.org>,
	linux-kselftest@...r.kernel.org,
	tariqt@...dia.com,
	shuah@...nel.org,
	borisp@...dia.com,
	leon@...nel.org,
	davem@...emloft.net,
	horms@...nel.org,
	andrew+netdev@...n.ch,
	netdev@...r.kernel.org,
	saeedm@...dia.com,
	edumazet@...gle.com,
	willemdebruijn.kernel@...il.com,
	donald.hunter@...il.com,
	pabeni@...hat.com,
	mbloch@...dia.com
Subject: Re: [net-next,7/9] mlx5: psp: implement deferred tx key deletion

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
mlx5: psp: implement deferred tx key deletion

This patch implements the deferred tx key deletion API for mlx5. The
mlx5e_psp_tx_grace_begin() function records WQE counts on each tx queue,
and mlx5e_psp_tx_grace_end() returns success only after all tx queues
have advanced a full ring cycle past the snapshot point.

> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.h
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.h
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.h
> @@ -22,10 +22,17 @@ struct mlx5e_psp_stats {
>  	u64 psp_tx_bytes_drop;
>  };
>
> +struct mlx5e_psp_tx_snapshot {
> +	int num_channels;
> +	int num_tc;
> +	u64 wqes[];
> +};
> +
>  struct mlx5e_psp {
>  	struct psp_dev *psp;
>  	struct psp_dev_caps caps;
>  	struct mlx5e_psp_fs *fs;
> +	struct mlx5e_psp_tx_snapshot *tx_snapshot;
>  	atomic_t tx_key_cnt;
>  	atomic_t tx_drop;
>  };

Can the tx_snapshot allocation be leaked during device teardown?

If mlx5e_psp_tx_grace_begin() is called and allocates tx_snapshot, but
mlx5e_psp_cleanup() runs before mlx5e_psp_tx_grace_end() frees it:

    mlx5e_psp_cleanup()
        kfree(psp);   // psp->tx_snapshot not freed

The tx_snapshot memory would be leaked. Should mlx5e_psp_cleanup() free
psp->tx_snapshot before freeing psp?