net: ethtool: fix leaking netdev ref if ethnl_default_parse() failed

Ido spotted that I made a mistake in commit under Fixes,
ethnl_default_parse() may acquire a dev reference even when it returns
an error. This may have been driven by the code structure in dumps
(which unconditionally release dev before handling errors), but it's
too much of a trap. Functions should undo what they did before returning
an error, rather than expecting caller to clean up.

Rather than fixing ethnl_default_set_doit() directly make
ethnl_default_parse() clean up errors.

Reported-by: Ido Schimmel <idosch@idosch.org>
Link: https://lore.kernel.org/aGEPszpq9eojNF4Y@shredder
Fixes: 963781bdfe20 ("net: ethtool: call .parse_request for SET handlers")
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20250630154053.1074664-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c
index 09c81cc9a08f0dc8361855d0126abf6627d3000e..b1f8999c1adcd988b5a02576d04a48d58e2670e5 100644 (file)
--- a/net/ethtool/netlink.c
+++ b/net/ethtool/netlink.c
@@ -455,10 +455,15 @@ static int ethnl_default_parse(struct ethnl_req_info *req_info,
        if (request_ops->parse_request) {
                ret = request_ops->parse_request(req_info, tb, info->extack);
                if (ret < 0)
-                       return ret;
+                       goto err_dev;
        }
 
        return 0;
+
+err_dev:
+       netdev_put(req_info->dev, &req_info->dev_tracker);
+       req_info->dev = NULL;
+       return ret;
 }
 
 /**
@@ -508,7 +513,7 @@ static int ethnl_default_doit(struct sk_buff *skb, struct genl_info *info)
 
        ret = ethnl_default_parse(req_info, info, ops, !ops->allow_nodev_do);
        if (ret < 0)
-               goto err_dev;
+               goto err_free;
        ethnl_init_reply_data(reply_data, ops, req_info->dev);
 
        rtnl_lock();
@@ -554,6 +559,7 @@ err_cleanup:
                ops->cleanup_data(reply_data);
 err_dev:
        netdev_put(req_info->dev, &req_info->dev_tracker);
+err_free:
        kfree(reply_data);
        kfree(req_info);
        return ret;
@@ -656,6 +662,8 @@ static int ethnl_default_start(struct netlink_callback *cb)
        }
 
        ret = ethnl_default_parse(req_info, &info->info, ops, false);
+       if (ret < 0)
+               goto free_reply_data;
        if (req_info->dev) {
                /* We ignore device specification in dump requests but as the
                 * same parser as for non-dump (doit) requests is used, it
@@ -664,8 +672,6 @@ static int ethnl_default_start(struct netlink_callback *cb)
                netdev_put(req_info->dev, &req_info->dev_tracker);
                req_info->dev = NULL;
        }
-       if (ret < 0)
-               goto free_reply_data;
 
        ctx->ops = ops;
        ctx->req_info = req_info;
@@ -714,13 +720,13 @@ static int ethnl_perphy_start(struct netlink_callback *cb)
         * the dev's ifindex, .dumpit() will grab and release the netdev itself.
         */
        ret = ethnl_default_parse(req_info, &info->info, ops, false);
+       if (ret < 0)
+               goto free_reply_data;
        if (req_info->dev) {
                phy_ctx->ifindex = req_info->dev->ifindex;
                netdev_put(req_info->dev, &req_info->dev_tracker);
                req_info->dev = NULL;
        }
-       if (ret < 0)
-               goto free_reply_data;
 
        ctx->ops = ops;
        ctx->req_info = req_info;