public inbox for dev@dpdk.org
 help / color / mirror / Atom feed
From: Long Li <longli@microsoft.com>
To: dev@dpdk.org
Cc: stephen@networkplumber.org, longli@microsoft.com,
	weh@microsoft.com, stable@dpdk.org
Subject: [PATCH v4 5/6] net/netvsc: fix resource leaks in MTU change path
Date: Tue,  3 Mar 2026 12:54:08 -0800	[thread overview]
Message-ID: <20260303205411.325585-6-longli@microsoft.com> (raw)
In-Reply-To: <20260303205411.325585-1-longli@microsoft.com>

hn_dev_mtu_set() has several resource management bugs:

1. Calls rte_free(hv->channels[0]) without rte_vmbus_chan_close()
   first, skipping the VMBus close protocol.

2. Does not free hv->primary->rxbuf_info before hn_detach(), causing
   hn_nvs_conn_rxbuf() in hn_reinit() to leak the old allocation.

3. Does not call hn_chim_uninit()/hn_chim_init() around the
   detach/reinit sequence, leaving a stale chimney bitmap that may
   not match the new chim_cnt.

Fix all three issues.

Fixes: 45c83603087e ("net/netvsc: support MTU set")
Cc: stable@dpdk.org
Signed-off-by: Long Li <longli@microsoft.com>
---
v4: NULL out closed subchannel pointers and reset num_queues after
    closing secondary channels. Reassign hv->primary->chan after
    reopening channel.
v3: New patch (split from reconfig patch).
---
 drivers/net/netvsc/hn_ethdev.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/net/netvsc/hn_ethdev.c b/drivers/net/netvsc/hn_ethdev.c
index 5e954b8812..23114a7c22 100644
--- a/drivers/net/netvsc/hn_ethdev.c
+++ b/drivers/net/netvsc/hn_ethdev.c
@@ -1214,14 +1214,23 @@ hn_dev_mtu_set(struct rte_eth_dev *dev, uint16_t mtu)
 	if (ret)
 		return ret;
 
+	/* Free chimney bitmap and rxbuf_info before NVS detach */
+	hn_chim_uninit(dev);
+	rte_free(hv->primary->rxbuf_info);
+	hv->primary->rxbuf_info = NULL;
+
 	/* Release channel resources */
 	hn_detach(hv);
 
 	/* Close any secondary vmbus channels */
-	for (i = 1; i < hv->num_queues; i++)
+	for (i = 1; i < hv->num_queues; i++) {
 		rte_vmbus_chan_close(hv->channels[i]);
+		hv->channels[i] = NULL;
+	}
+	hv->num_queues = 1;
 
 	/* Close primary vmbus channel */
+	rte_vmbus_chan_close(hv->channels[0]);
 	rte_free(hv->channels[0]);
 
 	/* Unmap and re-map vmbus device */
@@ -1245,16 +1254,21 @@ hn_dev_mtu_set(struct rte_eth_dev *dev, uint16_t mtu)
 		return ret;
 	}
 
+	hv->primary->chan = hv->channels[0];
 	rte_vmbus_set_latency(hv->vmbus, hv->channels[0], hv->latency);
 
 	ret = hn_reinit(dev, mtu);
-	if (!ret)
+	if (!ret) {
+		hn_chim_init(dev);
 		goto out;
+	}
 
 	/* In case of error, attempt to restore original MTU */
 	ret = hn_reinit(dev, orig_mtu);
 	if (ret)
 		PMD_DRV_LOG(ERR, "Restoring original MTU failed for netvsc");
+	else
+		hn_chim_init(dev);
 
 	ret = hn_vf_mtu_set(dev, orig_mtu);
 	if (ret)
-- 
2.43.0


  parent reply	other threads:[~2026-03-03 20:54 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-03 20:54 [PATCH v4 0/6] net/netvsc: bug fixes and runtime queue reconfiguration Long Li
2026-03-03 20:54 ` [PATCH v4 1/6] net/netvsc: fix subchannel leak on device removal Long Li
2026-03-03 20:54 ` [PATCH v4 2/6] net/netvsc: fix double-free of primary Rx queue on uninit Long Li
2026-03-03 20:54 ` [PATCH v4 3/6] net/netvsc: fix resource leak in init error path Long Li
2026-03-03 20:54 ` [PATCH v4 4/6] net/netvsc: fix event callback leak on rxfilter failure Long Li
2026-03-03 20:54 ` Long Li [this message]
2026-03-03 20:54 ` [PATCH v4 6/6] net/netvsc: support runtime queue count reconfiguration Long Li
2026-03-03 22:16 ` [PATCH v4 0/6] net/netvsc: bug fixes and runtime queue reconfiguration Stephen Hemminger
2026-03-03 22:30   ` [EXTERNAL] " Long Li

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260303205411.325585-6-longli@microsoft.com \
    --to=longli@microsoft.com \
    --cc=dev@dpdk.org \
    --cc=stable@dpdk.org \
    --cc=stephen@networkplumber.org \
    --cc=weh@microsoft.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox