[Intel-wired-lan] [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[Intel-wired-lan] [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[Ally Heev]

Uninitialized pointers with `__free` attribute can cause undefined
behavior as the memory assigned randomly to the pointer is freed
automatically when the pointer goes out of scope.

We could just fix it by initializing the pointer to NULL, but, as usage of
cleanup attributes is discouraged in net [1], trying to achieve cleanup
using goto

[1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs

Signed-off-by: Ally Heev <allyheev@gmail.com>
---
Ally Heev (2):
      ice: remove __free usage in ice_flow
      idpf: remove __free usage in idpf_virtchnl

 drivers/net/ethernet/intel/ice/ice_flow.c       |  6 ++++--
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 28 +++++++++++++++++--------
 2 files changed, 23 insertions(+), 11 deletions(-)
---
base-commit: 24598358a1b4ca1d596b8e7b34a7bc76f54e630f
change-id: 20251113-aheev-fix-free-uninitialized-ptrs-ethernet-intel-abc0cc9278d8

Best regards,
-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQBFRpOLrIakF7DYvaWPaLUP9d7HAUCaRn0WAAKCRCWPaLUP9d7
HPCSAP4tu8ld+4Og65tjSYNChRqIR4Gn8C546JFeozyQW6uj3wD/SQEPIidSAYbb
klXrZrKIBOc/avt55S2+krl241aNJA8=
=guHM
-----END PGP SIGNATURE-----
-- 
Ally Heev <allyheev@gmail.com>

[RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[Ally Heev]

Uninitialized pointers with `__free` attribute can cause undefined
behavior as the memory assigned randomly to the pointer is freed
automatically when the pointer goes out of scope.

We could just fix it by initializing the pointer to NULL, but, as usage of
cleanup attributes is discouraged in net [1], trying to achieve cleanup
using goto

[1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs

Signed-off-by: Ally Heev <allyheev@gmail.com>
---
Ally Heev (2):
      ice: remove __free usage in ice_flow
      idpf: remove __free usage in idpf_virtchnl

 drivers/net/ethernet/intel/ice/ice_flow.c       |  6 ++++--
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 28 +++++++++++++++++--------
 2 files changed, 23 insertions(+), 11 deletions(-)
---
base-commit: 24598358a1b4ca1d596b8e7b34a7bc76f54e630f
change-id: 20251113-aheev-fix-free-uninitialized-ptrs-ethernet-intel-abc0cc9278d8

Best regards,
-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQBFRpOLrIakF7DYvaWPaLUP9d7HAUCaRn0WAAKCRCWPaLUP9d7
HPCSAP4tu8ld+4Og65tjSYNChRqIR4Gn8C546JFeozyQW6uj3wD/SQEPIidSAYbb
klXrZrKIBOc/avt55S2+krl241aNJA8=
=guHM
-----END PGP SIGNATURE-----
-- 
Ally Heev <allyheev@gmail.com>

[Intel-wired-lan] [PATCH RESEND RFT net-next 1/2] ice: remove __free usage in ice_flow

[Ally Heev]

usage of cleanup attributes is discouraged in net [1], achieve cleanup
using goto

Suggested-by: Simon Horman <horms@kernel.org>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
Signed-off-by: Ally Heev <allyheev@gmail.com>

[1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs

Signed-off-by: Ally Heev <allyheev@gmail.com>
---
 drivers/net/ethernet/intel/ice/ice_flow.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_flow.c b/drivers/net/ethernet/intel/ice/ice_flow.c
index 6d5c939dc8a515c252cd2b77d155b69fa264ee92..dd62f5f14d60401d6a24cb9f86664425db1532d0 100644
--- a/drivers/net/ethernet/intel/ice/ice_flow.c
+++ b/drivers/net/ethernet/intel/ice/ice_flow.c
@@ -1573,7 +1573,7 @@ ice_flow_set_parser_prof(struct ice_hw *hw, u16 dest_vsi, u16 fdir_vsi,
 			 struct ice_parser_profile *prof, enum ice_block blk)
 {
 	u64 id = find_first_bit(prof->ptypes, ICE_FLOW_PTYPE_MAX);
-	struct ice_flow_prof_params *params __free(kfree);
+	struct ice_flow_prof_params *params = NULL;
 	u8 fv_words = hw->blk[blk].es.fvw;
 	int status;
 	int i, idx;
@@ -1621,12 +1621,14 @@ ice_flow_set_parser_prof(struct ice_hw *hw, u16 dest_vsi, u16 fdir_vsi,
 			      params->attr, params->attr_cnt,
 			      params->es, params->mask, false, false);
 	if (status)
-		return status;
+		goto out;
 
 	status = ice_flow_assoc_fdir_prof(hw, blk, dest_vsi, fdir_vsi, id);
 	if (status)
 		ice_rem_prof(hw, blk, id);
 
+out:
+	kfree(params);
 	return status;
 }
 

-- 
2.47.3

[PATCH RESEND RFT net-next 1/2] ice: remove __free usage in ice_flow

[Ally Heev]

usage of cleanup attributes is discouraged in net [1], achieve cleanup
using goto

Suggested-by: Simon Horman <horms@kernel.org>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
Signed-off-by: Ally Heev <allyheev@gmail.com>

[1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs

Signed-off-by: Ally Heev <allyheev@gmail.com>
---
 drivers/net/ethernet/intel/ice/ice_flow.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_flow.c b/drivers/net/ethernet/intel/ice/ice_flow.c
index 6d5c939dc8a515c252cd2b77d155b69fa264ee92..dd62f5f14d60401d6a24cb9f86664425db1532d0 100644
--- a/drivers/net/ethernet/intel/ice/ice_flow.c
+++ b/drivers/net/ethernet/intel/ice/ice_flow.c
@@ -1573,7 +1573,7 @@ ice_flow_set_parser_prof(struct ice_hw *hw, u16 dest_vsi, u16 fdir_vsi,
 			 struct ice_parser_profile *prof, enum ice_block blk)
 {
 	u64 id = find_first_bit(prof->ptypes, ICE_FLOW_PTYPE_MAX);
-	struct ice_flow_prof_params *params __free(kfree);
+	struct ice_flow_prof_params *params = NULL;
 	u8 fv_words = hw->blk[blk].es.fvw;
 	int status;
 	int i, idx;
@@ -1621,12 +1621,14 @@ ice_flow_set_parser_prof(struct ice_hw *hw, u16 dest_vsi, u16 fdir_vsi,
 			      params->attr, params->attr_cnt,
 			      params->es, params->mask, false, false);
 	if (status)
-		return status;
+		goto out;
 
 	status = ice_flow_assoc_fdir_prof(hw, blk, dest_vsi, fdir_vsi, id);
 	if (status)
 		ice_rem_prof(hw, blk, id);
 
+out:
+	kfree(params);
 	return status;
 }
 

-- 
2.47.3

Re: [Intel-wired-lan] [PATCH RESEND RFT net-next 1/2] ice: remove __free usage in ice_flow

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Ally Heev
> Sent: Monday, November 24, 2025 8:41 AM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric
> Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> Abeni <pabeni@redhat.com>
> Cc: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; Ally Heev <allyheev@gmail.com>; Simon Horman
> <horms@kernel.org>; Dan Carpenter <dan.carpenter@linaro.org>
> Subject: [Intel-wired-lan] [PATCH RESEND RFT net-next 1/2] ice: remove
> __free usage in ice_flow
> 
> usage of cleanup attributes is discouraged in net [1], achieve cleanup
> using goto
> 
> Suggested-by: Simon Horman <horms@kernel.org>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> 
> [1] https://docs.kernel.org/process/maintainer-netdev.html#using-
> device-managed-and-cleanup-h-constructs
> 
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
>  drivers/net/ethernet/intel/ice/ice_flow.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_flow.c
> b/drivers/net/ethernet/intel/ice/ice_flow.c
> index
> 6d5c939dc8a515c252cd2b77d155b69fa264ee92..dd62f5f14d60401d6a24cb9f8666
> 4425db1532d0 100644
> --- a/drivers/net/ethernet/intel/ice/ice_flow.c
> +++ b/drivers/net/ethernet/intel/ice/ice_flow.c
> @@ -1573,7 +1573,7 @@ ice_flow_set_parser_prof(struct ice_hw *hw, u16
> dest_vsi, u16 fdir_vsi,
>  			 struct ice_parser_profile *prof, enum ice_block
> blk)  {
>  	u64 id = find_first_bit(prof->ptypes, ICE_FLOW_PTYPE_MAX);
> -	struct ice_flow_prof_params *params __free(kfree);
> +	struct ice_flow_prof_params *params = NULL;
>  	u8 fv_words = hw->blk[blk].es.fvw;
>  	int status;
>  	int i, idx;
> @@ -1621,12 +1621,14 @@ ice_flow_set_parser_prof(struct ice_hw *hw,
> u16 dest_vsi, u16 fdir_vsi,
>  			      params->attr, params->attr_cnt,
>  			      params->es, params->mask, false, false);
>  	if (status)
> -		return status;
> +		goto out;
> 
>  	status = ice_flow_assoc_fdir_prof(hw, blk, dest_vsi, fdir_vsi,
> id);
>  	if (status)
>  		ice_rem_prof(hw, blk, id);
> 
> +out:
> +	kfree(params);
>  	return status;
>  }
> 
> 
> --
> 2.47.3

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

RE: [Intel-wired-lan] [PATCH RESEND RFT net-next 1/2] ice: remove __free usage in ice_flow

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Ally Heev
> Sent: Monday, November 24, 2025 8:41 AM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric
> Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> Abeni <pabeni@redhat.com>
> Cc: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; Ally Heev <allyheev@gmail.com>; Simon Horman
> <horms@kernel.org>; Dan Carpenter <dan.carpenter@linaro.org>
> Subject: [Intel-wired-lan] [PATCH RESEND RFT net-next 1/2] ice: remove
> __free usage in ice_flow
> 
> usage of cleanup attributes is discouraged in net [1], achieve cleanup
> using goto
> 
> Suggested-by: Simon Horman <horms@kernel.org>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> 
> [1] https://docs.kernel.org/process/maintainer-netdev.html#using-
> device-managed-and-cleanup-h-constructs
> 
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
>  drivers/net/ethernet/intel/ice/ice_flow.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_flow.c
> b/drivers/net/ethernet/intel/ice/ice_flow.c
> index
> 6d5c939dc8a515c252cd2b77d155b69fa264ee92..dd62f5f14d60401d6a24cb9f8666
> 4425db1532d0 100644
> --- a/drivers/net/ethernet/intel/ice/ice_flow.c
> +++ b/drivers/net/ethernet/intel/ice/ice_flow.c
> @@ -1573,7 +1573,7 @@ ice_flow_set_parser_prof(struct ice_hw *hw, u16
> dest_vsi, u16 fdir_vsi,
>  			 struct ice_parser_profile *prof, enum ice_block
> blk)  {
>  	u64 id = find_first_bit(prof->ptypes, ICE_FLOW_PTYPE_MAX);
> -	struct ice_flow_prof_params *params __free(kfree);
> +	struct ice_flow_prof_params *params = NULL;
>  	u8 fv_words = hw->blk[blk].es.fvw;
>  	int status;
>  	int i, idx;
> @@ -1621,12 +1621,14 @@ ice_flow_set_parser_prof(struct ice_hw *hw,
> u16 dest_vsi, u16 fdir_vsi,
>  			      params->attr, params->attr_cnt,
>  			      params->es, params->mask, false, false);
>  	if (status)
> -		return status;
> +		goto out;
> 
>  	status = ice_flow_assoc_fdir_prof(hw, blk, dest_vsi, fdir_vsi,
> id);
>  	if (status)
>  		ice_rem_prof(hw, blk, id);
> 
> +out:
> +	kfree(params);
>  	return status;
>  }
> 
> 
> --
> 2.47.3

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

[Intel-wired-lan] [PATCH RESEND RFT net-next 2/2] idpf: remove __free usage in idpf_virtchnl

[Ally Heev]

usage of cleanup attributes is discouraged in net [1], achieve cleanup
using goto. In this patch though, only uninitialized pointers with __free
attribute are cleaned as they can cause undefined behavior when they
go out of scope

Suggested-by: Simon Horman <horms@kernel.org>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
Signed-off-by: Ally Heev <allyheev@gmail.com>

[1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs

Signed-off-by: Ally Heev <allyheev@gmail.com>
---
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 28 +++++++++++++++++--------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index cbb5fa30f5a0ec778c1ee30470da3ca21cc1af24..5b2bf8c3205bc1ea0746f78afa2a24f3f8ad2a8c 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -1012,7 +1012,7 @@ static int idpf_send_get_caps_msg(struct idpf_adapter *adapter)
  */
 static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)
 {
-	struct virtchnl2_get_lan_memory_regions *rcvd_regions __free(kfree);
+	struct virtchnl2_get_lan_memory_regions *rcvd_regions = NULL;
 	struct idpf_vc_xn_params xn_params = {
 		.vc_op = VIRTCHNL2_OP_GET_LAN_MEMORY_REGIONS,
 		.recv_buf.iov_len = IDPF_CTLQ_MAX_BUF_LEN,
@@ -1029,21 +1029,29 @@ static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)
 
 	xn_params.recv_buf.iov_base = rcvd_regions;
 	reply_sz = idpf_vc_xn_exec(adapter, &xn_params);
-	if (reply_sz < 0)
-		return reply_sz;
+	if (reply_sz < 0) {
+		err = reply_sz;
+		goto out;
+	}
 
 	num_regions = le16_to_cpu(rcvd_regions->num_memory_regions);
 	size = struct_size(rcvd_regions, mem_reg, num_regions);
-	if (reply_sz < size)
-		return -EIO;
+	if (reply_sz < size) {
+		err = -EIO;
+		goto out;
+	}
 
-	if (size > IDPF_CTLQ_MAX_BUF_LEN)
-		return -EINVAL;
+	if (size > IDPF_CTLQ_MAX_BUF_LEN) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	hw = &adapter->hw;
 	hw->lan_regs = kcalloc(num_regions, sizeof(*hw->lan_regs), GFP_KERNEL);
-	if (!hw->lan_regs)
-		return -ENOMEM;
+	if (!hw->lan_regs) {
+		err = -ENOMEM;
+		goto out;
+	}
 
 	for (int i = 0; i < num_regions; i++) {
 		hw->lan_regs[i].addr_len =
@@ -1053,6 +1061,8 @@ static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)
 	}
 	hw->num_lan_regs = num_regions;
 
+out:
+	kfree(rcvd_regions);
 	return err;
 }
 

-- 
2.47.3

[PATCH RESEND RFT net-next 2/2] idpf: remove __free usage in idpf_virtchnl

[Ally Heev]

usage of cleanup attributes is discouraged in net [1], achieve cleanup
using goto. In this patch though, only uninitialized pointers with __free
attribute are cleaned as they can cause undefined behavior when they
go out of scope

Suggested-by: Simon Horman <horms@kernel.org>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
Signed-off-by: Ally Heev <allyheev@gmail.com>

[1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs

Signed-off-by: Ally Heev <allyheev@gmail.com>
---
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 28 +++++++++++++++++--------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index cbb5fa30f5a0ec778c1ee30470da3ca21cc1af24..5b2bf8c3205bc1ea0746f78afa2a24f3f8ad2a8c 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -1012,7 +1012,7 @@ static int idpf_send_get_caps_msg(struct idpf_adapter *adapter)
  */
 static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)
 {
-	struct virtchnl2_get_lan_memory_regions *rcvd_regions __free(kfree);
+	struct virtchnl2_get_lan_memory_regions *rcvd_regions = NULL;
 	struct idpf_vc_xn_params xn_params = {
 		.vc_op = VIRTCHNL2_OP_GET_LAN_MEMORY_REGIONS,
 		.recv_buf.iov_len = IDPF_CTLQ_MAX_BUF_LEN,
@@ -1029,21 +1029,29 @@ static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)
 
 	xn_params.recv_buf.iov_base = rcvd_regions;
 	reply_sz = idpf_vc_xn_exec(adapter, &xn_params);
-	if (reply_sz < 0)
-		return reply_sz;
+	if (reply_sz < 0) {
+		err = reply_sz;
+		goto out;
+	}
 
 	num_regions = le16_to_cpu(rcvd_regions->num_memory_regions);
 	size = struct_size(rcvd_regions, mem_reg, num_regions);
-	if (reply_sz < size)
-		return -EIO;
+	if (reply_sz < size) {
+		err = -EIO;
+		goto out;
+	}
 
-	if (size > IDPF_CTLQ_MAX_BUF_LEN)
-		return -EINVAL;
+	if (size > IDPF_CTLQ_MAX_BUF_LEN) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	hw = &adapter->hw;
 	hw->lan_regs = kcalloc(num_regions, sizeof(*hw->lan_regs), GFP_KERNEL);
-	if (!hw->lan_regs)
-		return -ENOMEM;
+	if (!hw->lan_regs) {
+		err = -ENOMEM;
+		goto out;
+	}
 
 	for (int i = 0; i < num_regions; i++) {
 		hw->lan_regs[i].addr_len =
@@ -1053,6 +1061,8 @@ static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)
 	}
 	hw->num_lan_regs = num_regions;
 
+out:
+	kfree(rcvd_regions);
 	return err;
 }
 

-- 
2.47.3

Re: [Intel-wired-lan] [PATCH RESEND RFT net-next 2/2] idpf: remove __free usage in idpf_virtchnl

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Ally Heev
> Sent: Monday, November 24, 2025 8:41 AM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric
> Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> Abeni <pabeni@redhat.com>
> Cc: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; Ally Heev <allyheev@gmail.com>; Simon Horman
> <horms@kernel.org>; Dan Carpenter <dan.carpenter@linaro.org>
> Subject: [Intel-wired-lan] [PATCH RESEND RFT net-next 2/2] idpf:
> remove __free usage in idpf_virtchnl
> 
> usage of cleanup attributes is discouraged in net [1], achieve cleanup
> using goto. In this patch though, only uninitialized pointers with
> __free attribute are cleaned as they can cause undefined behavior when
> they go out of scope
> 
> Suggested-by: Simon Horman <horms@kernel.org>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> 
> [1] https://docs.kernel.org/process/maintainer-netdev.html#using-
> device-managed-and-cleanup-h-constructs
> 
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
>  drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 28
> +++++++++++++++++--------
>  1 file changed, 19 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> index
> cbb5fa30f5a0ec778c1ee30470da3ca21cc1af24..5b2bf8c3205bc1ea0746f78afa2a
> 24f3f8ad2a8c 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> @@ -1012,7 +1012,7 @@ static int idpf_send_get_caps_msg(struct
> idpf_adapter *adapter)
>   */
>  static int idpf_send_get_lan_memory_regions(struct idpf_adapter
> *adapter)  {
> -	struct virtchnl2_get_lan_memory_regions *rcvd_regions
> __free(kfree);
> +	struct virtchnl2_get_lan_memory_regions *rcvd_regions = NULL;
>  	struct idpf_vc_xn_params xn_params = {
>  		.vc_op = VIRTCHNL2_OP_GET_LAN_MEMORY_REGIONS,
>  		.recv_buf.iov_len = IDPF_CTLQ_MAX_BUF_LEN, @@ -1029,21
> +1029,29 @@ static int idpf_send_get_lan_memory_regions(struct
> idpf_adapter *adapter)
> 
>  	xn_params.recv_buf.iov_base = rcvd_regions;
>  	reply_sz = idpf_vc_xn_exec(adapter, &xn_params);
> -	if (reply_sz < 0)
> -		return reply_sz;
> +	if (reply_sz < 0) {
> +		err = reply_sz;
> +		goto out;
> +	}
> 
>  	num_regions = le16_to_cpu(rcvd_regions->num_memory_regions);
>  	size = struct_size(rcvd_regions, mem_reg, num_regions);
> -	if (reply_sz < size)
> -		return -EIO;
> +	if (reply_sz < size) {
> +		err = -EIO;
> +		goto out;
> +	}
> 
> -	if (size > IDPF_CTLQ_MAX_BUF_LEN)
> -		return -EINVAL;
> +	if (size > IDPF_CTLQ_MAX_BUF_LEN) {
> +		err = -EINVAL;
> +		goto out;
> +	}
> 
>  	hw = &adapter->hw;
>  	hw->lan_regs = kcalloc(num_regions, sizeof(*hw->lan_regs),
> GFP_KERNEL);
> -	if (!hw->lan_regs)
> -		return -ENOMEM;
> +	if (!hw->lan_regs) {
> +		err = -ENOMEM;
> +		goto out;
> +	}
> 
>  	for (int i = 0; i < num_regions; i++) {
>  		hw->lan_regs[i].addr_len =
> @@ -1053,6 +1061,8 @@ static int
> idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)
>  	}
>  	hw->num_lan_regs = num_regions;
> 
> +out:
> +	kfree(rcvd_regions);
>  	return err;
>  }
> 
> 
> --
> 2.47.3

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

RE: [Intel-wired-lan] [PATCH RESEND RFT net-next 2/2] idpf: remove __free usage in idpf_virtchnl

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Ally Heev
> Sent: Monday, November 24, 2025 8:41 AM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric
> Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> Abeni <pabeni@redhat.com>
> Cc: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; Ally Heev <allyheev@gmail.com>; Simon Horman
> <horms@kernel.org>; Dan Carpenter <dan.carpenter@linaro.org>
> Subject: [Intel-wired-lan] [PATCH RESEND RFT net-next 2/2] idpf:
> remove __free usage in idpf_virtchnl
> 
> usage of cleanup attributes is discouraged in net [1], achieve cleanup
> using goto. In this patch though, only uninitialized pointers with
> __free attribute are cleaned as they can cause undefined behavior when
> they go out of scope
> 
> Suggested-by: Simon Horman <horms@kernel.org>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> 
> [1] https://docs.kernel.org/process/maintainer-netdev.html#using-
> device-managed-and-cleanup-h-constructs
> 
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
>  drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 28
> +++++++++++++++++--------
>  1 file changed, 19 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> index
> cbb5fa30f5a0ec778c1ee30470da3ca21cc1af24..5b2bf8c3205bc1ea0746f78afa2a
> 24f3f8ad2a8c 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> @@ -1012,7 +1012,7 @@ static int idpf_send_get_caps_msg(struct
> idpf_adapter *adapter)
>   */
>  static int idpf_send_get_lan_memory_regions(struct idpf_adapter
> *adapter)  {
> -	struct virtchnl2_get_lan_memory_regions *rcvd_regions
> __free(kfree);
> +	struct virtchnl2_get_lan_memory_regions *rcvd_regions = NULL;
>  	struct idpf_vc_xn_params xn_params = {
>  		.vc_op = VIRTCHNL2_OP_GET_LAN_MEMORY_REGIONS,
>  		.recv_buf.iov_len = IDPF_CTLQ_MAX_BUF_LEN, @@ -1029,21
> +1029,29 @@ static int idpf_send_get_lan_memory_regions(struct
> idpf_adapter *adapter)
> 
>  	xn_params.recv_buf.iov_base = rcvd_regions;
>  	reply_sz = idpf_vc_xn_exec(adapter, &xn_params);
> -	if (reply_sz < 0)
> -		return reply_sz;
> +	if (reply_sz < 0) {
> +		err = reply_sz;
> +		goto out;
> +	}
> 
>  	num_regions = le16_to_cpu(rcvd_regions->num_memory_regions);
>  	size = struct_size(rcvd_regions, mem_reg, num_regions);
> -	if (reply_sz < size)
> -		return -EIO;
> +	if (reply_sz < size) {
> +		err = -EIO;
> +		goto out;
> +	}
> 
> -	if (size > IDPF_CTLQ_MAX_BUF_LEN)
> -		return -EINVAL;
> +	if (size > IDPF_CTLQ_MAX_BUF_LEN) {
> +		err = -EINVAL;
> +		goto out;
> +	}
> 
>  	hw = &adapter->hw;
>  	hw->lan_regs = kcalloc(num_regions, sizeof(*hw->lan_regs),
> GFP_KERNEL);
> -	if (!hw->lan_regs)
> -		return -ENOMEM;
> +	if (!hw->lan_regs) {
> +		err = -ENOMEM;
> +		goto out;
> +	}
> 
>  	for (int i = 0; i < num_regions; i++) {
>  		hw->lan_regs[i].addr_len =
> @@ -1053,6 +1061,8 @@ static int
> idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter)
>  	}
>  	hw->num_lan_regs = num_regions;
> 
> +out:
> +	kfree(rcvd_regions);
>  	return err;
>  }
> 
> 
> --
> 2.47.3

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

Re: [Intel-wired-lan] [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[Tony Nguyen]

On 11/23/2025 11:40 PM, Ally Heev wrote:
> Uninitialized pointers with `__free` attribute can cause undefined
> behavior as the memory assigned randomly to the pointer is freed
> automatically when the pointer goes out of scope.
> 
> We could just fix it by initializing the pointer to NULL, but, as usage of
> cleanup attributes is discouraged in net [1], trying to achieve cleanup
> using goto

These two drivers already have multiple other usages of this. All the 
other instances initialize to NULL; I'd prefer to see this do the same 
over changing this single instance.

Thanks,
Tony

> [1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs
> 
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
> Ally Heev (2):
>        ice: remove __free usage in ice_flow
>        idpf: remove __free usage in idpf_virtchnl
> 
>   drivers/net/ethernet/intel/ice/ice_flow.c       |  6 ++++--
>   drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 28 +++++++++++++++++--------
>   2 files changed, 23 insertions(+), 11 deletions(-)
> ---
> base-commit: 24598358a1b4ca1d596b8e7b34a7bc76f54e630f
> change-id: 20251113-aheev-fix-free-uninitialized-ptrs-ethernet-intel-abc0cc9278d8
> 
> Best regards,
> -----BEGIN PGP SIGNATURE-----
> 
> iHUEABYKAB0WIQQBFRpOLrIakF7DYvaWPaLUP9d7HAUCaRn0WAAKCRCWPaLUP9d7
> HPCSAP4tu8ld+4Og65tjSYNChRqIR4Gn8C546JFeozyQW6uj3wD/SQEPIidSAYbb
> klXrZrKIBOc/avt55S2+krl241aNJA8=
> =guHM
> -----END PGP SIGNATURE-----

Re: [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[Tony Nguyen]

On 11/23/2025 11:40 PM, Ally Heev wrote:
> Uninitialized pointers with `__free` attribute can cause undefined
> behavior as the memory assigned randomly to the pointer is freed
> automatically when the pointer goes out of scope.
> 
> We could just fix it by initializing the pointer to NULL, but, as usage of
> cleanup attributes is discouraged in net [1], trying to achieve cleanup
> using goto

These two drivers already have multiple other usages of this. All the 
other instances initialize to NULL; I'd prefer to see this do the same 
over changing this single instance.

Thanks,
Tony

> [1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs
> 
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
> Ally Heev (2):
>        ice: remove __free usage in ice_flow
>        idpf: remove __free usage in idpf_virtchnl
> 
>   drivers/net/ethernet/intel/ice/ice_flow.c       |  6 ++++--
>   drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 28 +++++++++++++++++--------
>   2 files changed, 23 insertions(+), 11 deletions(-)
> ---
> base-commit: 24598358a1b4ca1d596b8e7b34a7bc76f54e630f
> change-id: 20251113-aheev-fix-free-uninitialized-ptrs-ethernet-intel-abc0cc9278d8
> 
> Best regards,
> -----BEGIN PGP SIGNATURE-----
> 
> iHUEABYKAB0WIQQBFRpOLrIakF7DYvaWPaLUP9d7HAUCaRn0WAAKCRCWPaLUP9d7
> HPCSAP4tu8ld+4Og65tjSYNChRqIR4Gn8C546JFeozyQW6uj3wD/SQEPIidSAYbb
> klXrZrKIBOc/avt55S2+krl241aNJA8=
> =guHM
> -----END PGP SIGNATURE-----

Re: [Intel-wired-lan] [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[ally heev]

On Mon, 2025-12-01 at 13:40 -0800, Tony Nguyen wrote:
> 
> On 11/23/2025 11:40 PM, Ally Heev wrote:
> > Uninitialized pointers with `__free` attribute can cause undefined
> > behavior as the memory assigned randomly to the pointer is freed
> > automatically when the pointer goes out of scope.
> > 
> > We could just fix it by initializing the pointer to NULL, but, as usage of
> > cleanup attributes is discouraged in net [1], trying to achieve cleanup
> > using goto
> 
> These two drivers already have multiple other usages of this. All the 
> other instances initialize to NULL; I'd prefer to see this do the same 
> over changing this single instance.
> 

Other usages are slightly complicated to be refactored and might need
good testing. Do you want me to do it in a different series?


Regards,
Ally

Re: [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[ally heev]

On Mon, 2025-12-01 at 13:40 -0800, Tony Nguyen wrote:
> 
> On 11/23/2025 11:40 PM, Ally Heev wrote:
> > Uninitialized pointers with `__free` attribute can cause undefined
> > behavior as the memory assigned randomly to the pointer is freed
> > automatically when the pointer goes out of scope.
> > 
> > We could just fix it by initializing the pointer to NULL, but, as usage of
> > cleanup attributes is discouraged in net [1], trying to achieve cleanup
> > using goto
> 
> These two drivers already have multiple other usages of this. All the 
> other instances initialize to NULL; I'd prefer to see this do the same 
> over changing this single instance.
> 

Other usages are slightly complicated to be refactored and might need
good testing. Do you want me to do it in a different series?


Regards,
Ally

Re: [Intel-wired-lan] [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[Tony Nguyen]

On 12/2/2025 11:47 AM, ally heev wrote:
> On Mon, 2025-12-01 at 13:40 -0800, Tony Nguyen wrote:
>>
>> On 11/23/2025 11:40 PM, Ally Heev wrote:
>>> Uninitialized pointers with `__free` attribute can cause undefined
>>> behavior as the memory assigned randomly to the pointer is freed
>>> automatically when the pointer goes out of scope.
>>>
>>> We could just fix it by initializing the pointer to NULL, but, as usage of
>>> cleanup attributes is discouraged in net [1], trying to achieve cleanup
>>> using goto
>>
>> These two drivers already have multiple other usages of this. All the
>> other instances initialize to NULL; I'd prefer to see this do the same
>> over changing this single instance.
>>
> 
> Other usages are slightly complicated to be refactored and might need
> good testing. Do you want me to do it in a different series?

Hi Ally,

Sorry, I think I was unclear. I'd prefer these two initialized to NULL, 
to match the other usages, over removing the __free() from them.

Thanks,
Tony

> Regards,
> Ally

Re: [Intel-wired-lan] [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[ally heev]

On Tue, 2025-12-02 at 10:17 -0800, Tony Nguyen wrote:
> 
> On 12/2/2025 11:47 AM, ally heev wrote:
> > On Mon, 2025-12-01 at 13:40 -0800, Tony Nguyen wrote:
> > > 
> > > On 11/23/2025 11:40 PM, Ally Heev wrote:
> > > > Uninitialized pointers with `__free` attribute can cause undefined
> > > > behavior as the memory assigned randomly to the pointer is freed
> > > > automatically when the pointer goes out of scope.
> > > > 
> > > > We could just fix it by initializing the pointer to NULL, but, as usage of
> > > > cleanup attributes is discouraged in net [1], trying to achieve cleanup
> > > > using goto
> > > 
> > > These two drivers already have multiple other usages of this. All the
> > > other instances initialize to NULL; I'd prefer to see this do the same
> > > over changing this single instance.
> > > 
> > 
> > Other usages are slightly complicated to be refactored and might need
> > good testing. Do you want me to do it in a different series?
> 
> Hi Ally,
> 
> Sorry, I think I was unclear. I'd prefer these two initialized to NULL, 
> to match the other usages, over removing the __free() from them.

I had a patch for that already, but, isn't using __free discouraged in
networking drivers [1]? Simon was against it [2]

[2] https://lore.kernel.org/all/aQ9xp9pchMwml30P@horms.kernel.org/
[1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs

Regards,
Ally

Re: [Intel-wired-lan] [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[Przemek Kitszel]

On 12/3/25 09:09, ally heev wrote:
> On Tue, 2025-12-02 at 10:17 -0800, Tony Nguyen wrote:
>>
>> On 12/2/2025 11:47 AM, ally heev wrote:
>>> On Mon, 2025-12-01 at 13:40 -0800, Tony Nguyen wrote:
>>>>
>>>> On 11/23/2025 11:40 PM, Ally Heev wrote:
>>>>> Uninitialized pointers with `__free` attribute can cause undefined
>>>>> behavior as the memory assigned randomly to the pointer is freed
>>>>> automatically when the pointer goes out of scope.
>>>>>
>>>>> We could just fix it by initializing the pointer to NULL, but, as usage of
>>>>> cleanup attributes is discouraged in net [1], trying to achieve cleanup
>>>>> using goto
>>>>
>>>> These two drivers already have multiple other usages of this. All the
>>>> other instances initialize to NULL; I'd prefer to see this do the same
>>>> over changing this single instance.
>>>>
>>>
>>> Other usages are slightly complicated to be refactored and might need
>>> good testing. Do you want me to do it in a different series?
>>
>> Hi Ally,
>>
>> Sorry, I think I was unclear. I'd prefer these two initialized to NULL,
>> to match the other usages, over removing the __free() from them.
> 
> I had a patch for that already, but, isn't using __free discouraged in
> networking drivers [1]? Simon was against it [2]

you see, the construct is discouraged, so we don't use it everywhere,
but cleaning up just a little would not change the state of the matter
(IOW we will still be in "driver has some __free() usage" state).

TBH, I would not spent my time "undoing" all of the __free() that we
have already, especially the testing part sounds not fun.

Turning all usage points to "= NULL" is orthogonal, and would be great.

> 
> [2] https://lore.kernel.org/all/aQ9xp9pchMwml30P@horms.kernel.org/
> [1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs
> 
> Regards,
> Ally
> 

Re: [Intel-wired-lan] [RFT net-next PATCH RESEND 0/2] ethernet: intel: fix freeing uninitialized pointers with __free

[ally heev]

On Wed, 2025-12-03 at 09:45 +0100, Przemek Kitszel wrote:
> On 12/3/25 09:09, ally heev wrote:
> > On Tue, 2025-12-02 at 10:17 -0800, Tony Nguyen wrote:
> > > 
> > > On 12/2/2025 11:47 AM, ally heev wrote:
> > > > On Mon, 2025-12-01 at 13:40 -0800, Tony Nguyen wrote:
> > > > > 
> > > > > On 11/23/2025 11:40 PM, Ally Heev wrote:
> > > > > > Uninitialized pointers with `__free` attribute can cause undefined
> > > > > > behavior as the memory assigned randomly to the pointer is freed
> > > > > > automatically when the pointer goes out of scope.
> > > > > > 
> > > > > > We could just fix it by initializing the pointer to NULL, but, as usage of
> > > > > > cleanup attributes is discouraged in net [1], trying to achieve cleanup
> > > > > > using goto
> > > > > 
> > > > > These two drivers already have multiple other usages of this. All the
> > > > > other instances initialize to NULL; I'd prefer to see this do the same
> > > > > over changing this single instance.
> > > > > 
> > > > 
> > > > Other usages are slightly complicated to be refactored and might need
> > > > good testing. Do you want me to do it in a different series?
> > > 
> > > Hi Ally,
> > > 
> > > Sorry, I think I was unclear. I'd prefer these two initialized to NULL,
> > > to match the other usages, over removing the __free() from them.
> > 
> > I had a patch for that already, but, isn't using __free discouraged in
> > networking drivers [1]? Simon was against it [2]
> 
> you see, the construct is discouraged, so we don't use it everywhere,
> but cleaning up just a little would not change the state of the matter
> (IOW we will still be in "driver has some __free() usage" state).
> 

But still we can just fix the uninitialized ones the right way [1]
right? since we have to fix them anyway. There already a patch [2] for
that

[1]
https://lore.kernel.org/lkml/CAHk-=wiCOTW5UftUrAnvJkr6769D29tF7Of79gUjdQHS_TkF5A@mail.gmail.com/
[2]
https://lore.kernel.org/all/20251106-aheev-uninitialized-free-attr-net-ethernet-v3-1-ef2220f4f476@gmail.com/

> TBH, I would not spent my time "undoing" all of the __free() that we
> have already, especially the testing part sounds not fun.

+1

> 
> Turning all usage points to "= NULL" is orthogonal, and would be great.
> 
> > 
> > [2] https://lore.kernel.org/all/aQ9xp9pchMwml30P@horms.kernel.org/
> > [1] https://docs.kernel.org/process/maintainer-netdev.html#using-device-managed-and-cleanup-h-constructs
> > 
> > Regards,
> > Ally
> >