* [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery_probe()
@ 2025-12-06 15:51 ` Kohei Enju
0 siblings, 0 replies; 8+ messages in thread
From: Kohei Enju @ 2025-12-06 15:51 UTC (permalink / raw)
To: intel-wired-lan, netdev
Cc: Tony Nguyen, Przemek Kitszel, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Jedrzej Jagielski,
Mateusz Polchlopek, Stefan Wegrzyn, kohei.enju, Kohei Enju
ixgbe_recovery_probe() does not free the following resources in its
error path, unlike ixgbe_probe():
- adapter->io_addr
- adapter->jump_tables[0]
- adapter->mac_table
- adapter->rss_key
- adapter->af_xdp_zc_qps
The leaked MMIO region can be observed in /proc/vmallocinfo, and the
remaining leaks are reported by kmemleak.
Free these allocations and unmap the MMIO region on failure to avoid the
leaks.
Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode")
Signed-off-by: Kohei Enju <enjuk@amazon.com>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 4af3b3e71ff1..1bfec3fffae0 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -11508,6 +11508,11 @@ static int ixgbe_recovery_probe(struct ixgbe_adapter *adapter)
mutex_destroy(&adapter->hw.aci.lock);
ixgbe_release_hw_control(adapter);
clean_up_probe:
+ iounmap(adapter->io_addr);
+ kfree(adapter->jump_tables[0]);
+ kfree(adapter->mac_table);
+ kfree(adapter->rss_key);
+ bitmap_free(adapter->af_xdp_zc_qps);
disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
free_netdev(netdev);
devlink_free(adapter->devlink);
--
2.52.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery_probe()
2025-12-06 15:51 ` Kohei Enju
@ 2025-12-08 17:06 ` Simon Horman
-1 siblings, 0 replies; 8+ messages in thread
From: Simon Horman @ 2025-12-08 17:06 UTC (permalink / raw)
To: Kohei Enju
Cc: intel-wired-lan, netdev, Tony Nguyen, Przemek Kitszel,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Jedrzej Jagielski, Mateusz Polchlopek,
Stefan Wegrzyn, kohei.enju
On Sun, Dec 07, 2025 at 12:51:27AM +0900, Kohei Enju wrote:
> ixgbe_recovery_probe() does not free the following resources in its
> error path, unlike ixgbe_probe():
> - adapter->io_addr
> - adapter->jump_tables[0]
> - adapter->mac_table
> - adapter->rss_key
> - adapter->af_xdp_zc_qps
>
> The leaked MMIO region can be observed in /proc/vmallocinfo, and the
> remaining leaks are reported by kmemleak.
>
> Free these allocations and unmap the MMIO region on failure to avoid the
> leaks.
>
> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode")
> Signed-off-by: Kohei Enju <enjuk@amazon.com>
Hi,
It seems that ixgbe_recovery_probe() is only called from ixgbe_probe().
And that ixgbe_probe() already has an unwind ladder for these resources.
So I would suggest using that rather than replicating it
in ixgbe_recovery_probe. That is, have ixgbe_probe() unwind when
ixgbe_recovery_probe returns an error.
Also, maybe I'm wrong, but it seems that hw->aci.lock
is initialised more than once if ixgbe_recovery_probe() is called.
...
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery_probe()
@ 2025-12-08 17:06 ` Simon Horman
0 siblings, 0 replies; 8+ messages in thread
From: Simon Horman @ 2025-12-08 17:06 UTC (permalink / raw)
To: Kohei Enju
Cc: intel-wired-lan, netdev, Tony Nguyen, Przemek Kitszel,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Jedrzej Jagielski, Mateusz Polchlopek,
Stefan Wegrzyn, kohei.enju
On Sun, Dec 07, 2025 at 12:51:27AM +0900, Kohei Enju wrote:
> ixgbe_recovery_probe() does not free the following resources in its
> error path, unlike ixgbe_probe():
> - adapter->io_addr
> - adapter->jump_tables[0]
> - adapter->mac_table
> - adapter->rss_key
> - adapter->af_xdp_zc_qps
>
> The leaked MMIO region can be observed in /proc/vmallocinfo, and the
> remaining leaks are reported by kmemleak.
>
> Free these allocations and unmap the MMIO region on failure to avoid the
> leaks.
>
> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode")
> Signed-off-by: Kohei Enju <enjuk@amazon.com>
Hi,
It seems that ixgbe_recovery_probe() is only called from ixgbe_probe().
And that ixgbe_probe() already has an unwind ladder for these resources.
So I would suggest using that rather than replicating it
in ixgbe_recovery_probe. That is, have ixgbe_probe() unwind when
ixgbe_recovery_probe returns an error.
Also, maybe I'm wrong, but it seems that hw->aci.lock
is initialised more than once if ixgbe_recovery_probe() is called.
...
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery_probe()
2025-12-08 17:06 ` Simon Horman
(?)
@ 2025-12-09 1:14 ` Jacob Keller
2025-12-11 1:49 ` Kohei Enju
-1 siblings, 1 reply; 8+ messages in thread
From: Jacob Keller @ 2025-12-09 1:14 UTC (permalink / raw)
To: Simon Horman, Kohei Enju
Cc: intel-wired-lan, netdev, Tony Nguyen, Przemek Kitszel,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Jedrzej Jagielski, Mateusz Polchlopek,
Stefan Wegrzyn, kohei.enju
[-- Attachment #1.1: Type: text/plain, Size: 1764 bytes --]
On 12/8/2025 9:06 AM, Simon Horman wrote:
> On Sun, Dec 07, 2025 at 12:51:27AM +0900, Kohei Enju wrote:
>> ixgbe_recovery_probe() does not free the following resources in its
>> error path, unlike ixgbe_probe():
>> - adapter->io_addr
>> - adapter->jump_tables[0]
>> - adapter->mac_table
>> - adapter->rss_key
>> - adapter->af_xdp_zc_qps
>>
>> The leaked MMIO region can be observed in /proc/vmallocinfo, and the
>> remaining leaks are reported by kmemleak.
>>
>> Free these allocations and unmap the MMIO region on failure to avoid the
>> leaks.
>>
>> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode")
>> Signed-off-by: Kohei Enju <enjuk@amazon.com>
>
> Hi,
>
> It seems that ixgbe_recovery_probe() is only called from ixgbe_probe().
> And that ixgbe_probe() already has an unwind ladder for these resources.
> So I would suggest using that rather than replicating it
> in ixgbe_recovery_probe. That is, have ixgbe_probe() unwind when
> ixgbe_recovery_probe returns an error.
Right. If resources are allocated by ixgbe_probe() they should be freed
in ixgbe_probe() and not in ixgbe_recovery_probe() which is a smaller
function called by ixgbe_probe() to enter recovery mode where only
devlink flash update is enabled.
It looks like most of these resources are allocated by probe and then
ixgbe_recovery_probe() is called, which should instead let regular probe
do cleanup for stuff it didn't setup itself.
>
> Also, maybe I'm wrong, but it seems that hw->aci.lock
> is initialised more than once if ixgbe_recovery_probe() is called.
>
Its initialized in ixgbe_sw_init, which is called before the
ixgbe_recovery_probe, so yes that does look like a double initialization.
> ...
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery_probe()
2025-12-09 1:14 ` [Intel-wired-lan] " Jacob Keller
@ 2025-12-11 1:49 ` Kohei Enju
0 siblings, 0 replies; 8+ messages in thread
From: Kohei Enju @ 2025-12-11 1:49 UTC (permalink / raw)
To: jacob.e.keller
Cc: andrew+netdev, anthony.l.nguyen, davem, edumazet, enjuk, horms,
intel-wired-lan, jedrzej.jagielski, kohei.enju, kuba,
mateusz.polchlopek, netdev, pabeni, przemyslaw.kitszel,
stefan.wegrzyn
On Mon, 8 Dec 2025 17:14:28 -0800, Jacob Keller wrote:
>
>
>On 12/8/2025 9:06 AM, Simon Horman wrote:
>> On Sun, Dec 07, 2025 at 12:51:27AM +0900, Kohei Enju wrote:
>>> ixgbe_recovery_probe() does not free the following resources in its
>>> error path, unlike ixgbe_probe():
>>> - adapter->io_addr
>>> - adapter->jump_tables[0]
>>> - adapter->mac_table
>>> - adapter->rss_key
>>> - adapter->af_xdp_zc_qps
>>>
>>> The leaked MMIO region can be observed in /proc/vmallocinfo, and the
>>> remaining leaks are reported by kmemleak.
>>>
>>> Free these allocations and unmap the MMIO region on failure to avoid the
>>> leaks.
>>>
>>> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode")
>>> Signed-off-by: Kohei Enju <enjuk@amazon.com>
>>
>> Hi,
>>
>> It seems that ixgbe_recovery_probe() is only called from ixgbe_probe().
>> And that ixgbe_probe() already has an unwind ladder for these resources.
>> So I would suggest using that rather than replicating it
>> in ixgbe_recovery_probe. That is, have ixgbe_probe() unwind when
>> ixgbe_recovery_probe returns an error.
>
>Right. If resources are allocated by ixgbe_probe() they should be freed
>in ixgbe_probe() and not in ixgbe_recovery_probe() which is a smaller
>function called by ixgbe_probe() to enter recovery mode where only
>devlink flash update is enabled.
>
>It looks like most of these resources are allocated by probe and then
>ixgbe_recovery_probe() is called, which should instead let regular probe
>do cleanup for stuff it didn't setup itself.
That makes sense. I'll revise the patch and work on v2.
>
>>
>> Also, maybe I'm wrong, but it seems that hw->aci.lock
>> is initialised more than once if ixgbe_recovery_probe() is called.
>>
>
>Its initialized in ixgbe_sw_init, which is called before the
>ixgbe_recovery_probe, so yes that does look like a double initialization.
Good catch, I overlooked that. I'll address that as well.
Thank you for taking a look, Simon and Jacob.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery_probe()
2025-12-06 15:51 ` Kohei Enju
@ 2025-12-09 8:06 ` Loktionov, Aleksandr
-1 siblings, 0 replies; 8+ messages in thread
From: Loktionov, Aleksandr @ 2025-12-09 8:06 UTC (permalink / raw)
To: Kohei Enju, intel-wired-lan@lists.osuosl.org,
netdev@vger.kernel.org
Cc: Nguyen, Anthony L, Kitszel, Przemyslaw, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Jagielski, Jedrzej, Mateusz Polchlopek, Wegrzyn, Stefan,
kohei.enju@gmail.com
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Kohei Enju
> Sent: Saturday, December 6, 2025 4:51 PM
> To: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric
> Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> Abeni <pabeni@redhat.com>; Jagielski, Jedrzej
> <jedrzej.jagielski@intel.com>; Mateusz Polchlopek
> <mateusz.polchlopek@intel.com>; Wegrzyn, Stefan
> <stefan.wegrzyn@intel.com>; kohei.enju@gmail.com; Kohei Enju
> <enjuk@amazon.com>
> Subject: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks
> in ixgbe_recovery_probe()
>
> ixgbe_recovery_probe() does not free the following resources in its
> error path, unlike ixgbe_probe():
> - adapter->io_addr
> - adapter->jump_tables[0]
> - adapter->mac_table
> - adapter->rss_key
> - adapter->af_xdp_zc_qps
>
> The leaked MMIO region can be observed in /proc/vmallocinfo, and the
> remaining leaks are reported by kmemleak.
>
> Free these allocations and unmap the MMIO region on failure to avoid
> the leaks.
>
> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery
> mode")
> Signed-off-by: Kohei Enju <enjuk@amazon.com>
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> index 4af3b3e71ff1..1bfec3fffae0 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> @@ -11508,6 +11508,11 @@ static int ixgbe_recovery_probe(struct
> ixgbe_adapter *adapter)
> mutex_destroy(&adapter->hw.aci.lock);
> ixgbe_release_hw_control(adapter);
> clean_up_probe:
> + iounmap(adapter->io_addr);
> + kfree(adapter->jump_tables[0]);
> + kfree(adapter->mac_table);
> + kfree(adapter->rss_key);
> + bitmap_free(adapter->af_xdp_zc_qps);
> disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter-
> >state);
> free_netdev(netdev);
> devlink_free(adapter->devlink);
> --
> 2.52.0
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
^ permalink raw reply [flat|nested] 8+ messages in thread* RE: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery_probe()
@ 2025-12-09 8:06 ` Loktionov, Aleksandr
0 siblings, 0 replies; 8+ messages in thread
From: Loktionov, Aleksandr @ 2025-12-09 8:06 UTC (permalink / raw)
To: Kohei Enju, intel-wired-lan@lists.osuosl.org,
netdev@vger.kernel.org
Cc: Nguyen, Anthony L, Kitszel, Przemyslaw, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Jagielski, Jedrzej, Mateusz Polchlopek, Wegrzyn, Stefan,
kohei.enju@gmail.com
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Kohei Enju
> Sent: Saturday, December 6, 2025 4:51 PM
> To: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric
> Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> Abeni <pabeni@redhat.com>; Jagielski, Jedrzej
> <jedrzej.jagielski@intel.com>; Mateusz Polchlopek
> <mateusz.polchlopek@intel.com>; Wegrzyn, Stefan
> <stefan.wegrzyn@intel.com>; kohei.enju@gmail.com; Kohei Enju
> <enjuk@amazon.com>
> Subject: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks
> in ixgbe_recovery_probe()
>
> ixgbe_recovery_probe() does not free the following resources in its
> error path, unlike ixgbe_probe():
> - adapter->io_addr
> - adapter->jump_tables[0]
> - adapter->mac_table
> - adapter->rss_key
> - adapter->af_xdp_zc_qps
>
> The leaked MMIO region can be observed in /proc/vmallocinfo, and the
> remaining leaks are reported by kmemleak.
>
> Free these allocations and unmap the MMIO region on failure to avoid
> the leaks.
>
> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery
> mode")
> Signed-off-by: Kohei Enju <enjuk@amazon.com>
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> index 4af3b3e71ff1..1bfec3fffae0 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> @@ -11508,6 +11508,11 @@ static int ixgbe_recovery_probe(struct
> ixgbe_adapter *adapter)
> mutex_destroy(&adapter->hw.aci.lock);
> ixgbe_release_hw_control(adapter);
> clean_up_probe:
> + iounmap(adapter->io_addr);
> + kfree(adapter->jump_tables[0]);
> + kfree(adapter->mac_table);
> + kfree(adapter->rss_key);
> + bitmap_free(adapter->af_xdp_zc_qps);
> disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter-
> >state);
> free_netdev(netdev);
> devlink_free(adapter->devlink);
> --
> 2.52.0
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
^ permalink raw reply [flat|nested] 8+ messages in thread