[PATCH net 0/1] octeontx2-af: CGX: fix bitmap leaks

[PATCH net 0/1] octeontx2-af: CGX: fix bitmap leaks

[Bo Sun]

This patch frees the RX/TX flow-control bitmaps in cgx_lmac_exit().
The leak was introduced in commit e740003874ed ("octeontx2-af:Flow
control resource management") and should be back-ported to stable.


Bo Sun (1):
  octeontx2-af: CGX: fix bitmap leaks

 drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 ++
 1 file changed, 2 insertions(+)

[PATCH net 1/1] octeontx2-af: CGX: fix bitmap leaks

[Bo Sun]

The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)
are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().
Unbinding and rebinding the driver therefore triggers kmemleak:

    unreferenced object (size 16):
        backtrace:
          rvu_alloc_bitmap
          cgx_probe

Free both bitmaps during teardown.

Fixes: e740003874ed ("octeontx2-af: Flow control resource management")
Cc: stable@vger.kernel.org
Signed-off-by: Bo Sun <bo@mboxify.com>
---
 drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
index ec0e11c77cbf..f56e6782c4de 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
@@ -1823,6 +1823,8 @@ static int cgx_lmac_exit(struct cgx *cgx)
 		cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, false);
 		cgx_configure_interrupt(cgx, lmac, lmac->lmac_id, true);
 		kfree(lmac->mac_to_index_bmap.bmap);
+		kfree(lmac->rx_fc_pfvf_bmap.bmap);
+		kfree(lmac->tx_fc_pfvf_bmap.bmap);
 		kfree(lmac->name);
 		kfree(lmac);
 	}

Re: [PATCH net 1/1] octeontx2-af: CGX: fix bitmap leaks

[Alexander Lobakin]

From: Bo Sun <bo@mboxify.com>
Date: Mon, 20 Oct 2025 22:31:12 +0800

> The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)
> are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().
> Unbinding and rebinding the driver therefore triggers kmemleak:
> 
>     unreferenced object (size 16):
>         backtrace:
>           rvu_alloc_bitmap
>           cgx_probe
> 
> Free both bitmaps during teardown.
> 
> Fixes: e740003874ed ("octeontx2-af: Flow control resource management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bo Sun <bo@mboxify.com>

Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>

> ---
>  drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
> index ec0e11c77cbf..f56e6782c4de 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
> @@ -1823,6 +1823,8 @@ static int cgx_lmac_exit(struct cgx *cgx)
>  		cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, false);
>  		cgx_configure_interrupt(cgx, lmac, lmac->lmac_id, true);
>  		kfree(lmac->mac_to_index_bmap.bmap);
> +		kfree(lmac->rx_fc_pfvf_bmap.bmap);
> +		kfree(lmac->tx_fc_pfvf_bmap.bmap);
>  		kfree(lmac->name);
>  		kfree(lmac);
>  	}

Thanks,
Olek

Re: [PATCH net 1/1] octeontx2-af: CGX: fix bitmap leaks

[Jakub Kicinski]

On Mon, 20 Oct 2025 22:31:12 +0800 Bo Sun wrote:
> The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)
> are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().
> Unbinding and rebinding the driver therefore triggers kmemleak:
> 
>     unreferenced object (size 16):
>         backtrace:
>           rvu_alloc_bitmap
>           cgx_probe
> 
> Free both bitmaps during teardown.
> 
> Fixes: e740003874ed ("octeontx2-af: Flow control resource management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bo Sun <bo@mboxify.com>

Looks like rvu_free_bitmap() exists. We should probably use it?

> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
> index ec0e11c77cbf..f56e6782c4de 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
> @@ -1823,6 +1823,8 @@ static int cgx_lmac_exit(struct cgx *cgx)
>  		cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, false);
>  		cgx_configure_interrupt(cgx, lmac, lmac->lmac_id, true);
>  		kfree(lmac->mac_to_index_bmap.bmap);
> +		kfree(lmac->rx_fc_pfvf_bmap.bmap);
> +		kfree(lmac->tx_fc_pfvf_bmap.bmap);
>  		kfree(lmac->name);
>  		kfree(lmac);
>  	}
-- 
pw-bot: cr

Re: [PATCH net 1/1] octeontx2-af: CGX: fix bitmap leaks

[Bo Sun]

On 10/23/2025 9:22 AM, Jakub Kicinski wrote:
> On Mon, 20 Oct 2025 22:31:12 +0800 Bo Sun wrote:
>> The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)
>> are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().
>> Unbinding and rebinding the driver therefore triggers kmemleak:
>>
>>      unreferenced object (size 16):
>>          backtrace:
>>            rvu_alloc_bitmap
>>            cgx_probe
>>
>> Free both bitmaps during teardown.
>>
>> Fixes: e740003874ed ("octeontx2-af: Flow control resource management")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Bo Sun <bo@mboxify.com>
> 
> Looks like rvu_free_bitmap() exists. We should probably use it?

Apologies for the late reply.
You're right that rvu_free_bitmap() exists. I stayed with direct kfree()
for consistency with the existing code in cgx_lmac_exit(), because which
already uses kfree(lmac->mac_to_index_bmap.bmap).

That said, I'm OK with either way:
1. Keep kfree() to match the existing pattern in this function
2. Switch all three bitmap frees (including mac_to_index_bmap) to use
rvu_free_bitmap() for consistency with the alloc/free API pairing

What's your preference?

Thanks,
Bo

> 
>> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
>> index ec0e11c77cbf..f56e6782c4de 100644
>> --- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
>> +++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
>> @@ -1823,6 +1823,8 @@ static int cgx_lmac_exit(struct cgx *cgx)
>>   		cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, false);
>>   		cgx_configure_interrupt(cgx, lmac, lmac->lmac_id, true);
>>   		kfree(lmac->mac_to_index_bmap.bmap);
>> +		kfree(lmac->rx_fc_pfvf_bmap.bmap);
>> +		kfree(lmac->tx_fc_pfvf_bmap.bmap);
>>   		kfree(lmac->name);
>>   		kfree(lmac);
>>   	}

Re: [PATCH net 1/1] octeontx2-af: CGX: fix bitmap leaks

[Jakub Kicinski]

On Thu, 5 Feb 2026 21:35:29 +0800 Bo Sun wrote:
> >> Fixes: e740003874ed ("octeontx2-af: Flow control resource management")
> >> Cc: stable@vger.kernel.org
> >> Signed-off-by: Bo Sun <bo@mboxify.com>  
> > 
> > Looks like rvu_free_bitmap() exists. We should probably use it?  
> 
> Apologies for the late reply.
> You're right that rvu_free_bitmap() exists. I stayed with direct kfree()
> for consistency with the existing code in cgx_lmac_exit(), because which
> already uses kfree(lmac->mac_to_index_bmap.bmap).
> 
> That said, I'm OK with either way:
> 1. Keep kfree() to match the existing pattern in this function
> 2. Switch all three bitmap frees (including mac_to_index_bmap) to use
> rvu_free_bitmap() for consistency with the alloc/free API pairing
> 
> What's your preference?

3. do what I implied, just use rvu_free_bitmap() in this single case
for the fix. Follow up separately with a patch to remaining sites if
any to convert from kfree() to rvu_free_bitmap(). We want the fix
itself to be small, the cleanup should be separate.

Re: [PATCH net 1/1] octeontx2-af: CGX: fix bitmap leaks

[bo]

On 2026-02-05 23:48, Jakub Kicinski wrote:
> On Thu, 5 Feb 2026 21:35:29 +0800 Bo Sun wrote:
>> >> Fixes: e740003874ed ("octeontx2-af: Flow control resource management")
>> >> Cc: stable@vger.kernel.org
>> >> Signed-off-by: Bo Sun <bo@mboxify.com>
>> >
>> > Looks like rvu_free_bitmap() exists. We should probably use it?
>> 
>> Apologies for the late reply.
>> You're right that rvu_free_bitmap() exists. I stayed with direct 
>> kfree()
>> for consistency with the existing code in cgx_lmac_exit(), because 
>> which
>> already uses kfree(lmac->mac_to_index_bmap.bmap).
>> 
>> That said, I'm OK with either way:
>> 1. Keep kfree() to match the existing pattern in this function
>> 2. Switch all three bitmap frees (including mac_to_index_bmap) to use
>> rvu_free_bitmap() for consistency with the alloc/free API pairing
>> 
>> What's your preference?
> 
> 3. do what I implied, just use rvu_free_bitmap() in this single case
> for the fix. Follow up separately with a patch to remaining sites if
> any to convert from kfree() to rvu_free_bitmap(). We want the fix
> itself to be small, the cleanup should be separate.

Thanks, I'll send v2.