Re: [PATCH 1/7] net/ice: fix DDP package double free on init failure

[Bruce Richardson <bruce.richardson@intel.com>]

On Tue, Oct 27, 2026 at 12:39:50PM +0000, Bruce Richardson wrote:
> On Tue, Oct 27, 2026 at 10:51:31AM +0000, Anurag Mandal wrote:
> > When ice_init_hw_tbls() fails, ice_dev_init() frees the DDP package
> > copy but leaves hw->pkg_copy and hw->seg pointing into it. Without
> > safe mode, the error path then calls ice_deinit_hw(), which frees
> > the package copy again through ice_free_seg().
> > 
> > Use ice_free_seg(), which also clears these pointers.
> > 
> > Fixes: 9c4f15901ada ("net/ice: free memory with matching allocator")
> > 
> > Signed-off-by: Anurag Mandal <anurag.mandal@intel.com>
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>

I think this needs a backport, because it also fixes:
Fixes: 7f7cbf80bdb7 ("net/ice: factorize firmware loading")

So will add that and CC stable on apply.

> > ---
> >  drivers/net/intel/ice/ice_ethdev.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/intel/ice/ice_ethdev.c b/drivers/net/intel/ice/ice_ethdev.c
> > index b846555b97..dd3a4976ab 100644
> > --- a/drivers/net/intel/ice/ice_ethdev.c
> > +++ b/drivers/net/intel/ice/ice_ethdev.c
> > @@ -2785,7 +2785,7 @@ ice_dev_init(struct rte_eth_dev *dev)
> >  		ret = ice_init_hw_tbls(hw);
> >  		if (ret) {
> >  			PMD_INIT_LOG(ERR, "ice_init_hw_tbls failed: %d", ret);
> > -			ice_free(hw, hw->pkg_copy);
> > +			ice_free_seg(hw);
> >  		}
> >  	}
> >  
> > -- 
> > 2.25.1
> >