Re: [BUG] devlink: region trigger leaks a permanent snapshot id slot on every successful auto-id capture

[Fernando Fernandez Mancera]

On 10/25/26 5:27 AM, Guikun Yang wrote:
> Hi Jiri, Jacob,
>
> devlink_nl_cmd_region_trigger() (net/devlink/region.c) allocates a
> snapshot id via __devlink_region_snapshot_id_get() when the request
> does not carry DEVLINK_ATTR_REGION_SNAPSHOT_ID, then creates the
> snapshot.  On the success path it returns without ever releasing the
> caller's reference, so the id's refcount stays at 2 instead of dropping
> to the snapshot-only 1.
>
> __devlink_region_snapshot_id_get() is documented as:
>
>   *	Note that the caller of this function counts as a 'user', in order to
>   *	avoid race conditions.  The caller must release its hold on the
>   *	snapshot by using devlink_region_snapshot_id_put.
>
> The netlink trigger is its own caller, and nothing in the kernel holds
> the id after the command returns, so the hold is never released.
>
> Consequences, per successful auto-id trigger:
>
>    xa_alloc(&devlink->snapshot_ids, id, xa_mk_value(1))   /* count = 1 */
>    __devlink_region_snapshot_create()                     /* count = 2 */
>    ... success, no put ...
>
> Later, when the snapshot is deleted, devlink_region_snapshot_del()
> calls __devlink_snapshot_id_decrement(), bringing the count to 1.
> Since it is not zero, the id is NOT erased from the xarray:
>
>   *	If the count reaches zero, erase this id from the xarray, freeing it
>   *	up for future re-use by devlink_region_snapshot_id_get().
>
> The slot stays occupied forever.  Every subsequent attempt to use that
> particular id fails:
>
>    - __devlink_snapshot_id_insert() rejects it with -EEXIST (xa_load()
>      finds the stale entry), so a user can never explicitly re-create a
>      snapshot with that id;
>    - reading or deleting "the snapshot with that id" returns -ENOENT,
>      so there is also no way to clean the stale entry up.

Yes, this is right. I am sending a patch. I reproduced it on netdevsim 
and Intel E825-C with ice driver.

Not sure if it is worth writing a selftest, might consider it as a 
follow-up.

Thanks,
Fernando.