[PATCH v5 21/27] net/iavf: avoid rte malloc in IPsec operations

Anatoly Burakov
2026-02-17T12:17:01Z

Currently, when performing IPsec security association operations and
retrieving device capabilities, we are using rte_malloc followed by
immediate rte_free. This is not needed as these structures are only
used temporarily, so replace it with stack-allocated structures for
small fixed-size messages and regular malloc/free for variable-sized
buffers.

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
drivers/net/intel/iavf/iavf_ipsec_crypto.c | 58 ++++++++--------------
1 file changed, 21 insertions(+), 37 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_ipsec_crypto.c b/drivers/net/intel/iavf/iavf_ipsec_crypto.c
index cd85d91850..3274ce503c 100644
--- a/drivers/net/intel/iavf/iavf_ipsec_crypto.c
+++ b/drivers/net/intel/iavf/iavf_ipsec_crypto.c
@@ -3,6 +3,7 @@
*/

#include <stdalign.h>
+#include <stdlib.h>

#include <rte_cryptodev.h>
#include <rte_ethdev.h>
@@ -899,29 +900,18 @@ static uint32_t
iavf_ipsec_crypto_sa_del(struct iavf_adapter *adapter,
struct iavf_security_session *sess)
{
- struct inline_ipsec_msg *request = NULL, *response = NULL;
- size_t request_len, response_len;
+ struct {
+ struct inline_ipsec_msg msg;
+ struct virtchnl_ipsec_sa_destroy sa_destroy;
+ } req;
+ struct {
+ struct inline_ipsec_msg msg;
+ struct virtchnl_ipsec_resp resp;
+ } resp;
+ struct inline_ipsec_msg *request = &req.msg, *response = &resp.msg;

int rc = 0;

- request_len = sizeof(struct inline_ipsec_msg) +
- sizeof(struct virtchnl_ipsec_sa_destroy);
-
- request = rte_malloc("iavf-sa-del-request", request_len, 0);
- if (request == NULL) {
- rc = -ENOMEM;
- goto update_cleanup;
- }
-
- response_len = sizeof(struct inline_ipsec_msg) +
- sizeof(struct virtchnl_ipsec_resp);
-
- response = rte_malloc("iavf-sa-del-response", response_len, 0);
- if (response == NULL) {
- rc = -ENOMEM;
- goto update_cleanup;
- }
-
/* set msg header params */
request->ipsec_opcode = INLINE_IPSEC_OP_SA_DESTROY;
request->req_id = (uint16_t)0xDEADBEEF;
@@ -939,10 +929,10 @@ iavf_ipsec_crypto_sa_del(struct iavf_adapter *adapter,

/* send virtual channel request to add SA to hardware database */
rc = iavf_ipsec_crypto_request(adapter,
- (uint8_t *)request, request_len,
- (uint8_t *)response, response_len);
+ (uint8_t *)request, sizeof(req),
+ (uint8_t *)response, sizeof(resp));
if (rc)
- goto update_cleanup;
+ return rc;

/* verify response */
if (response->ipsec_opcode != request->ipsec_opcode ||
@@ -957,10 +947,6 @@ iavf_ipsec_crypto_sa_del(struct iavf_adapter *adapter,
response->ipsec_data.ipsec_status->status)
rc = -EFAULT;

-update_cleanup:
- rte_free(response);
- rte_free(request);
-
return rc;
}

@@ -1113,7 +1099,7 @@ iavf_ipsec_crypto_device_capabilities_get(struct iavf_adapter *adapter,

request_len = sizeof(struct inline_ipsec_msg);

- request = rte_malloc("iavf-device-capability-request", request_len, 0);
+ request = calloc(1, request_len);
if (request == NULL) {
rc = -ENOMEM;
goto update_cleanup;
@@ -1121,8 +1107,7 @@ iavf_ipsec_crypto_device_capabilities_get(struct iavf_adapter *adapter,

response_len = sizeof(struct inline_ipsec_msg) +
sizeof(struct virtchnl_ipsec_cap);
- response = rte_malloc("iavf-device-capability-response",
- response_len, 0);
+ response = calloc(1, response_len);
if (response == NULL) {
rc = -ENOMEM;
goto update_cleanup;
@@ -1148,8 +1133,8 @@ iavf_ipsec_crypto_device_capabilities_get(struct iavf_adapter *adapter,
memcpy(capability, response->ipsec_data.ipsec_cap, sizeof(*capability));

update_cleanup:
- rte_free(response);
- rte_free(request);
+ free(response);
+ free(request);

return rc;
}
@@ -1538,7 +1523,7 @@ iavf_ipsec_crypto_status_get(struct iavf_adapter *adapter,

request_len = sizeof(struct inline_ipsec_msg);

- request = rte_malloc("iavf-device-status-request", request_len, 0);
+ request = calloc(1, request_len);
if (request == NULL) {
rc = -ENOMEM;
goto update_cleanup;
@@ -1546,8 +1531,7 @@ iavf_ipsec_crypto_status_get(struct iavf_adapter *adapter,

response_len = sizeof(struct inline_ipsec_msg) +
sizeof(struct virtchnl_ipsec_cap);
- response = rte_malloc("iavf-device-status-response",
- response_len, 0);
+ response = calloc(1, response_len);
if (response == NULL) {
rc = -ENOMEM;
goto update_cleanup;
@@ -1573,8 +1557,8 @@ iavf_ipsec_crypto_status_get(struct iavf_adapter *adapter,
memcpy(status, response->ipsec_data.ipsec_status, sizeof(*status));

update_cleanup:
- rte_free(response);
- rte_free(request);
+ free(response);
+ free(request);

return rc;
}
--
2.47.3