Re: [PATCH] IB/hfi1: Fix potential leaks in IPoIB TX queue initialization

[Leon Romanovsky <leon@kernel.org>]

On Wed, Nov 11, 2026 at 08:23:19PM +0800, Guangshuo Li wrote:
> When an SDMA header allocation fails, rollback skips the current TX
> queue. Its ring and already allocated headers are leaked. Free the
> partially initialized ring before unwinding the completed queues.

free_tx_ring already performs that, see "for (j = 0; j < tx_ring_size; j++)"
loop.

Thanks

> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: c874ad879c2f ("IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init")
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
> ---
>  drivers/infiniband/hw/hfi1/ipoib_tx.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
> index 8b9cc55db59d..2e9225b558b4 100644
> --- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
> +++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
> @@ -743,7 +743,7 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
>  				kzalloc_node(sizeof(*tx->sdma_hdr),
>  					     GFP_KERNEL, priv->dd->node);
>  			if (!hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr)
> -				goto free_txqs;
> +				goto free_tx_ring;
>  		}
>  
>  		netif_napi_add_tx(dev, &txq->napi, hfi1_ipoib_poll_tx_ring);
> @@ -751,6 +751,10 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
>  
>  	return 0;
>  
> +free_tx_ring:
> +	while (j--)
> +		kfree(hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr);
> +	kvfree(tx_ring->items);
>  free_txqs:
>  	for (i--; i >= 0; i--) {
>  		struct hfi1_ipoib_txq *txq = &priv->txqs[i];
> 
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
>