Re: [PATCH 1/8] net/ice: fix DCF hardware init error path

[Bruce Richardson <bruce.richardson@intel.com>]

On Thu, Nov 05, 2026 at 09:47:18AM +0000, Anurag Mandal wrote:
> ice_dcf_init_hw() never frees the VF VSI map on its error paths,
> so it leaks when any step after getting the map fails.
> 
> Similarly, when getting the VLAN offload V2 capabilities fails,
> the error path leaves the interrupt callback registered and
> enabled, and leaks the QoS bandwidth config array.
> As the DCF hardware structure passed to the callback is freed
> with the port when probe fails, a later interrupt would use
> freed memory.
> 
> Free the VSI map, and add an error label that disables the
> interrupt, unregisters the callback and frees the QoS array.
> 
> Fixes: 9a7980cfdf67 ("net/ice: complete VLAN offload capability for DCF")
> Fixes: 8e1cf1823191 ("net/ice: init RSS and supported RXDID in DCF")
> Fixes: 7564d5509611 ("net/ice: add DCF hardware initialization")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Anurag Mandal <anurag.mandal@intel.com>
> ---
>  drivers/net/intel/ice/ice_dcf.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

One comment inline below. [I can fix on apply if no other issues with the
set]

> diff --git a/drivers/net/intel/ice/ice_dcf.c b/drivers/net/intel/ice/ice_dcf.c
> index 976f2ed260..d87655c11d 100644
> --- a/drivers/net/intel/ice/ice_dcf.c
> +++ b/drivers/net/intel/ice/ice_dcf.c
> @@ -853,14 +853,23 @@ ice_dcf_init_hw(struct rte_eth_dev *eth_dev, struct ice_dcf_hw *hw)
>  
>  	if ((hw->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN_V2) &&
>  	    dcf_get_vlan_offload_caps_v2(hw))
> -		goto err_rss;
> +		goto err_intr;
>  
>  	return 0;
>  
> +err_intr:
> +	ice_dcf_disable_irq0(hw);
> +	rte_intr_disable(pci_dev->intr_handle);
> +	rte_intr_callback_unregister(pci_dev->intr_handle,
> +				     ice_dcf_dev_interrupt_handler, hw);

AI review points out that this would be better using unregister_sync rather
than just unregister.

> +	rte_free(hw->qos_bw_cfg);
> +	hw->qos_bw_cfg = NULL;
>  err_rss:
>  	rte_free(hw->rss_key);
>  	rte_free(hw->rss_lut);
>  err_alloc:
> +	rte_free(hw->vf_vsi_map);
> +	hw->vf_vsi_map = NULL;
>  	rte_free(hw->vf_res);
>  err_api:
>  	iavf_shutdown_adminq(&hw->avf);
> -- 
> 2.25.1
>