From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0C1E2E762C; Fri, 7 Aug 2026 14:54:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786114449; cv=none; b=npwLaHY9Wx740SLPdSxpTl5O+W5efct5/4M3CDkfxKB0IosRaCqE/wSxb5pC5eNbSAuF5X0UCFPisGVj8KXQUos0sIrWlrcFiCBeDGbvfTaAhyccCeLBKVsRPATVHnySW3FzbX1h8e5WAqSXG9VSclaoVE2NCOf/as5zmZcYBxQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786114449; c=relaxed/simple; bh=Fw3tYWIFDBr9ZEx6IjYsuukR30xVm6ufrcI3ql0YxS0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dkrcepMoPW9YvGum68HfVC9ZTAb8sB7Ulh9t2Mx9HSF58FfALoXvMqctFajRPeilDcu1I73sxN7YEC2Cfg3JUhaXRaZ40qE/rVcCt3qnlZ2a7hEk13/zThHcbzqjim67pPrk1/+0r592wy3z3b7ubt2Nk6UPV7jyXqZqVvrZLMg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=N4SgC112; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="N4SgC112" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11B021F000E9; Fri, 7 Aug 2026 14:54:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786114447; bh=lI0sPUEj2IDuvOPs9Ue0VCQUAYDo3gCdyhFCAetbjNs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=N4SgC112aJPBfF3xzOJJ1Gto8UGG20FWv3eO22PvhoBUP7LdSWsci4ItPGtK9xK8j ioYV9Wo+y01KBgZgaCb9Q4VzoAYazXL4VeQmkaSXupynUzotCkq54GWcptirzkUukP o/wTDgt8dW1FmM2nVEohoQ0HpM427X+6ElmLhEb8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Dawei Feng , Jacob Keller , Tony Nguyen , Rinitha S Subject: [PATCH 6.12 222/337] ice: fix memory leak in ice_lbtest_prepare_rings() Date: Fri, 7 Aug 2026 16:37:05 +0200 Message-ID: <20260807143423.368926040@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260807143418.516897842@linuxfoundation.org> References: <20260807143418.516897842@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dawei Feng commit 3a9de5590da4ffd9e9c541c4c4d492aa2b54cf6e upstream. ice_lbtest_prepare_rings() frees Rx rings only when ice_vsi_start_all_rx_rings() fails. If ice_vsi_setup_rx_rings() fails after allocating some descriptors, or if ice_vsi_cfg_lan() fails after the Rx rings were prepared, the function reaches the Tx cleanup path without releasing the initialized Rx resources. Fix this by adding separate unwind paths for Rx setup failure and LAN configuration failure. The Rx setup failure path releases the partially prepared Rx rings before freeing Tx rings, while later failures first undo the LAN Tx configuration and then release the Rx rings in reverse setup order. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings. As we do not have an Intel E800 Series adapter available to run the ethtool offline loopback selftest, no runtime testing was able to be performed. Fixes: 0e674aeb0b77 ("ice: Add handler for ethtool selftest") Cc: stable@vger.kernel.org Signed-off-by: Dawei Feng Reviewed-by: Jacob Keller Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c @@ -1067,18 +1067,18 @@ static int ice_lbtest_prepare_rings(stru status = ice_vsi_cfg_lan(vsi); if (status) - goto err_setup_rx_ring; + goto err_cfg_lan; status = ice_vsi_start_all_rx_rings(vsi); if (status) - goto err_start_rx_ring; + goto err_cfg_lan; return 0; -err_start_rx_ring: - ice_vsi_free_rx_rings(vsi); -err_setup_rx_ring: +err_cfg_lan: ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, 0); +err_setup_rx_ring: + ice_vsi_free_rx_rings(vsi); err_setup_tx_ring: ice_vsi_free_tx_rings(vsi);