[PATCH net] dpaa2-eth: fix xdp_rxq_info leak in dpaa2_eth_setup_rx_flow

[PATCH net] dpaa2-eth: fix xdp_rxq_info leak in dpaa2_eth_setup_rx_flow

[Fushuai Wang]

When xdp_rxq_info_reg_mem_model() fails after a successful
xdp_rxq_info_reg(), the kernel may leaks the registered RXQ
info structure. Fix this by calling xdp_rxq_info_unreg() in
the error path, ensuring proper cleanup when memory model
registration fails.

Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support")
Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
---
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
index 2ec2c3dab250..b4a62eae4719 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
@@ -3939,6 +3939,7 @@ static int dpaa2_eth_setup_rx_flow(struct dpaa2_eth_priv *priv,
 					 MEM_TYPE_PAGE_ORDER0, NULL);
 	if (err) {
 		dev_err(dev, "xdp_rxq_info_reg_mem_model failed\n");
+		xdp_rxq_info_unreg(&fq->channel->xdp_rxq);
 		return err;
 	}
 
-- 
2.36.1

Re: [PATCH net] dpaa2-eth: fix xdp_rxq_info leak in dpaa2_eth_setup_rx_flow

[Simon Horman]

On Tue, Jun 24, 2025 at 10:42:35PM +0800, Fushuai Wang wrote:
> When xdp_rxq_info_reg_mem_model() fails after a successful
> xdp_rxq_info_reg(), the kernel may leaks the registered RXQ
> info structure. Fix this by calling xdp_rxq_info_unreg() in
> the error path, ensuring proper cleanup when memory model
> registration fails.
> 
> Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support")
> Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>

Thanks, I agree this is needed.

Reviewed-by: Simon Horman <horms@kernel.org>

But I wonder how these resources are released in the following cases:

* Error in dpaa2_eth_bind_dpni() after at least one
  successful call to dpaa2_eth_setup_rx_flow()

* Error in dpaa2_eth_probe() after a successful call to
  dpaa2_eth_bind_dpni()

* Driver removal (dpaa2_eth_remove())

Re: [PATCH net] dpaa2-eth: fix xdp_rxq_info leak in dpaa2_eth_setup_rx_flow

[Fushuai Wang]

>> When xdp_rxq_info_reg_mem_model() fails after a successful
>> xdp_rxq_info_reg(), the kernel may leaks the registered RXQ
>> info structure. Fix this by calling xdp_rxq_info_unreg() in
>> the error path, ensuring proper cleanup when memory model
>> registration fails.
>>
>> Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support")
>> Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
> 
> Thanks, I agree this is needed.
> 
> Reviewed-by: Simon Horman <horms@kernel.org>
> 
> But I wonder how these resources are released in the following cases:
> 
> * Error in dpaa2_eth_bind_dpni() after at least one
>   successful call to dpaa2_eth_setup_rx_flow()
> 
> * Error in dpaa2_eth_probe() after a successful call to
>   dpaa2_eth_bind_dpni()
> 
> * Driver removal (dpaa2_eth_remove())

Hi, Simon

I think these paths also leak xdp_rxq_info.
I'll add cleanup for them and send v2 shortly.

--
Regards,
Wang

Re: [PATCH net] dpaa2-eth: fix xdp_rxq_info leak in dpaa2_eth_setup_rx_flow

[Simon Horman]

On Wed, Jun 25, 2025 at 08:55:47PM +0800, Fushuai Wang wrote:
> >> When xdp_rxq_info_reg_mem_model() fails after a successful
> >> xdp_rxq_info_reg(), the kernel may leaks the registered RXQ
> >> info structure. Fix this by calling xdp_rxq_info_unreg() in
> >> the error path, ensuring proper cleanup when memory model
> >> registration fails.
> >>
> >> Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support")
> >> Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
> > 
> > Thanks, I agree this is needed.
> > 
> > Reviewed-by: Simon Horman <horms@kernel.org>
> > 
> > But I wonder how these resources are released in the following cases:
> > 
> > * Error in dpaa2_eth_bind_dpni() after at least one
> >   successful call to dpaa2_eth_setup_rx_flow()
> > 
> > * Error in dpaa2_eth_probe() after a successful call to
> >   dpaa2_eth_bind_dpni()
> > 
> > * Driver removal (dpaa2_eth_remove())
> 
> Hi, Simon
> 
> I think these paths also leak xdp_rxq_info.
> I'll add cleanup for them and send v2 shortly.

Great, thanks.