Skip to contentSkip to conversation

bnxt: fix memory leak in bnxt_queue_mem_alloc error cases

PATCH Applied Will Chen 3 participants 3 messages Jul 29 – Aug 3

Subsystems (3)
Networking Network drivers Broadcom bnxt_en 50 gigabit Ethernet driver
lore
Share & tools
lore

Will Chen

author
#0 lore raw

PATCH v2 1/1 bnxt: fix memory leak in bnxt_queue_mem_alloc error cases

There is a small memory leak in bnxt_queue_mem_alloc:
when bnxt_alloc_rx_agg_bmap() succeeds
but bnxt_alloc_one_tpa_info() later fails, the rx_agg_bmap allocated by bnxt_alloc_rx_agg_bmap() is not freed in the fallthrough cleanup cases.

Free the rx_agg_bmap in the err_free_rx_agg_ring case and initialize clone->rx_agg_bmap = NULL earlier in the function to allow for safe fallthrough.

Fixes bd649c5cc958 ("bnxt_en: handle tpa_info in queue API implementation")
Signed-off-by Will Chen <[email protected]>
Reviewed-by Joe Damato <[email protected]>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++
 1 file changed, 3 insertions(+)

v2:
- Rearrange the order of the frees as suggested by Michael

v1: https://lore.kernel.org/netdev/[email protected]/

drivers/net/ethernet/broadcom/bnxt/bnxt.c +3 -0
index 7513618793da..004ef99f4530 100644
@@ -16217,6 +16217,7 @@ static int bnxt_queue_mem_alloc(struct net_device *dev,
 	clone->rx_next_cons = 0;
 	clone->need_head_pool = false;
 	clone->rx_page_size = qcfg->rx_page_size;
+	clone->rx_agg_bmap = NULL;
 
 	rc = bnxt_alloc_rx_page_pool(bp, clone, rxr->page_pool->p.nid);
 	if (rc)

@@ -16269,6 +16270,8 @@ static int bnxt_queue_mem_alloc(struct net_device *dev,
 	bnxt_free_one_tpa_info(bp, clone);
 err_free_rx_agg_ring:
 	bnxt_free_ring(bp, &clone->rx_agg_ring_struct.ring_mem);
+	kfree(clone->rx_agg_bmap);
+	clone->rx_agg_bmap = NULL;
 err_free_rx_ring:
 	bnxt_free_ring(bp, &clone->rx_ring_struct.ring_mem);
 err_rxq_info_unreg:

base-commit: 3f1f755366687d051174739fb99f7d560202f60b

Signature · 1 line
2.53.0-Meta
maintainer Reviewed-by on v2 1/1
#1 lore raw
Quoted 7 lines · Will Chen

There is a small memory leak in bnxt_queue_mem_alloc:
when bnxt_alloc_rx_agg_bmap() succeeds
but bnxt_alloc_one_tpa_info() later fails, the rx_agg_bmap allocated by bnxt_alloc_rx_agg_bmap() is not freed in the fallthrough cleanup cases.

Quoted 7 lines

Free the rx_agg_bmap in the err_free_rx_agg_ring case and initialize clone->rx_agg_bmap = NULL earlier in the function to allow for safe fallthrough.

Fixes bd649c5cc958 ("bnxt_en: handle tpa_info in queue API implementation")
Signed-off-by Will Chen <[email protected]>
Reviewed-by Joe Damato <[email protected]>

Thanks.

Reviewed-by Michael Chan <[email protected]>
CI Applied
#2 lore raw
In reply to Will Chen
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 11 lines · On Wed, 29 Jul 2026 15:01:31 -0700 you wrote:

There is a small memory leak in bnxt_queue_mem_alloc:
when bnxt_alloc_rx_agg_bmap() succeeds
but bnxt_alloc_one_tpa_info() later fails, the rx_agg_bmap allocated by bnxt_alloc_rx_agg_bmap() is not freed in the fallthrough cleanup cases.

Free the rx_agg_bmap in the err_free_rx_agg_ring case and initialize clone->rx_agg_bmap = NULL earlier in the function to allow for safe fallthrough.

[...]

Here is the summary with links:
- [net,v2] bnxt: fix memory leak in bnxt_queue_mem_alloc error cases

    https://git.kernel.org/netdev/net/c/d1000fd7995e

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html