From: xuanqiang.luo@linux.dev
To: intel-wired-lan@lists.osuosl.org
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Tony Nguyen <anthony.l.nguyen@intel.com>,
Przemek Kitszel <przemyslaw.kitszel@intel.com>,
Andrew Lunn <andrew+netdev@lunn.ch>,
Joshua Hay <joshua.a.hay@intel.com>,
Tatyana Nikolova <tatyana.e.nikolova@intel.com>,
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Subject: [PATCH iwl-net v1] idpf: fix lan_regs leak on core init failure
Date: Fri, 3 Jul 2026 18:41:32 +0800 [thread overview]
Message-ID: <20260703104132.47419-1-xuanqiang.luo@linux.dev> (raw)
From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
idpf_vc_core_init() gets the LAN memory region layout before mapping the
regions and allocating vport resources. Both layout paths allocate
hw->lan_regs, but later error paths return without freeing it.
idpf_vc_core_deinit() does not cover these paths because it returns unless
IDPF_VC_CORE_INIT is set, and that bit is set only after core init
succeeds.
Free hw->lan_regs on the post-allocation error paths and clear the
pointer and region count.
Fixes: 6aa53e861c1a ("idpf: implement get LAN MMIO memory regions")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index be66f9b2e101c..da49bb7b7e671 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -3479,6 +3479,7 @@ static int idpf_vport_params_buf_alloc(struct idpf_adapter *adapter)
*/
int idpf_vc_core_init(struct idpf_adapter *adapter)
{
+ struct idpf_hw *hw = &adapter->hw;
int task_delay = 30;
u16 num_max_vports;
int err = 0;
@@ -3550,15 +3551,18 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
if (err) {
dev_err(&adapter->pdev->dev, "Failed to map BAR0 region(s): %d\n",
err);
- return -ENOMEM;
+ err = -ENOMEM;
+ goto err_lan_regs;
}
pci_sriov_set_totalvfs(adapter->pdev, idpf_get_max_vfs(adapter));
num_max_vports = idpf_get_max_vports(adapter);
adapter->max_vports = num_max_vports;
adapter->vports = kzalloc_objs(*adapter->vports, num_max_vports);
- if (!adapter->vports)
- return -ENOMEM;
+ if (!adapter->vports) {
+ err = -ENOMEM;
+ goto err_lan_regs;
+ }
if (!adapter->netdevs) {
adapter->netdevs = kzalloc_objs(struct net_device *,
@@ -3624,6 +3628,10 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
err_netdev_alloc:
kfree(adapter->vports);
adapter->vports = NULL;
+err_lan_regs:
+ kfree(hw->lan_regs);
+ hw->lan_regs = NULL;
+ hw->num_lan_regs = 0;
return err;
init_failed:
--
2.43.0
WARNING: multiple messages have this Message-ID (diff)
From: xuanqiang.luo@linux.dev
To: intel-wired-lan@lists.osuosl.org
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Tony Nguyen <anthony.l.nguyen@intel.com>,
Przemek Kitszel <przemyslaw.kitszel@intel.com>,
Andrew Lunn <andrew+netdev@lunn.ch>,
Joshua Hay <joshua.a.hay@intel.com>,
Tatyana Nikolova <tatyana.e.nikolova@intel.com>,
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Subject: [Intel-wired-lan] [PATCH iwl-net v1] idpf: fix lan_regs leak on core init failure
Date: Fri, 3 Jul 2026 18:41:32 +0800 [thread overview]
Message-ID: <20260703104132.47419-1-xuanqiang.luo@linux.dev> (raw)
From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
idpf_vc_core_init() gets the LAN memory region layout before mapping the
regions and allocating vport resources. Both layout paths allocate
hw->lan_regs, but later error paths return without freeing it.
idpf_vc_core_deinit() does not cover these paths because it returns unless
IDPF_VC_CORE_INIT is set, and that bit is set only after core init
succeeds.
Free hw->lan_regs on the post-allocation error paths and clear the
pointer and region count.
Fixes: 6aa53e861c1a ("idpf: implement get LAN MMIO memory regions")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index be66f9b2e101c..da49bb7b7e671 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -3479,6 +3479,7 @@ static int idpf_vport_params_buf_alloc(struct idpf_adapter *adapter)
*/
int idpf_vc_core_init(struct idpf_adapter *adapter)
{
+ struct idpf_hw *hw = &adapter->hw;
int task_delay = 30;
u16 num_max_vports;
int err = 0;
@@ -3550,15 +3551,18 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
if (err) {
dev_err(&adapter->pdev->dev, "Failed to map BAR0 region(s): %d\n",
err);
- return -ENOMEM;
+ err = -ENOMEM;
+ goto err_lan_regs;
}
pci_sriov_set_totalvfs(adapter->pdev, idpf_get_max_vfs(adapter));
num_max_vports = idpf_get_max_vports(adapter);
adapter->max_vports = num_max_vports;
adapter->vports = kzalloc_objs(*adapter->vports, num_max_vports);
- if (!adapter->vports)
- return -ENOMEM;
+ if (!adapter->vports) {
+ err = -ENOMEM;
+ goto err_lan_regs;
+ }
if (!adapter->netdevs) {
adapter->netdevs = kzalloc_objs(struct net_device *,
@@ -3624,6 +3628,10 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
err_netdev_alloc:
kfree(adapter->vports);
adapter->vports = NULL;
+err_lan_regs:
+ kfree(hw->lan_regs);
+ hw->lan_regs = NULL;
+ hw->num_lan_regs = 0;
return err;
init_failed:
--
2.43.0
next reply other threads:[~2026-07-03 10:42 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-03 10:41 xuanqiang.luo [this message]
2026-07-03 10:41 ` [Intel-wired-lan] [PATCH iwl-net v1] idpf: fix lan_regs leak on core init failure xuanqiang.luo
2026-07-06 9:12 ` Jagielski, Jedrzej
2026-07-06 9:12 ` [Intel-wired-lan] " Jagielski, Jedrzej
2026-07-06 9:51 ` Marcin Szycik
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260703104132.47419-1-xuanqiang.luo@linux.dev \
--to=xuanqiang.luo@linux.dev \
--cc=andrew+netdev@lunn.ch \
--cc=anthony.l.nguyen@intel.com \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=joshua.a.hay@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luoxuanqiang@kylinos.cn \
--cc=netdev@vger.kernel.org \
--cc=przemyslaw.kitszel@intel.com \
--cc=tatyana.e.nikolova@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.