Re: [PATCH net v1] idpf: Fix vport IRQ name leak on request failure

[Simon Horman <horms@kernel.org>]

On Wed, Sep 23, 2026 at 07:48:06PM -0400, Yuho Choi wrote:
> idpf_vport_intr_req_irq() allocates a name for each vector IRQ before
> calling request_irq(). On success, the name is released later through
> kfree(free_irq()), but when request_irq() fails, the error path only
> unwinds the previous vectors and the name for the failed one is leaked.
> 
> Free the allocated name on the request_irq() failure path, as done for
> the mailbox IRQ in commit 9bff30482c10 ("idpf: Fix mailbox IRQ name leak
> on request failure").
> 
> Fixes: bf9bf7042a38 ("idpf: avoid bloating &idpf_q_vector with big %NR_CPUS")

I don't believe that commit introduced this problem.

> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
> ---
> Compile-tested only (x86_64 defconfig + CONFIG_IDPF=m, W=1).
> 
>  drivers/net/ethernet/intel/idpf/idpf_txrx.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> index 4311ffa30bb1..e7d5e7923371 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> @@ -4073,6 +4073,7 @@ static int idpf_vport_intr_req_irq(struct idpf_vport *vport,
>  		if (err) {
>  			netdev_err(vport->netdev,
>  				   "Request_irq failed, error: %d\n", err);
> +			kfree(name);

name is allocated by kasprintf() which is a wrapper around kvasprintf_const().
And kvasprintf_const() documents that it's return value should be freed
using kfree_const(). I don't think it will make any run-time difference
here, but perhaps it would be best to follow that convention.

Also, for completeness, shouldn't there be error handling for the case
where the allocation of name fails?

>  			goto free_q_irqs;
>  		}