[PATCH net-next] net: ngbe: fix memory leak in ngbe_probe() error path

[PATCH net-next] net: ngbe: fix memory leak in ngbe_probe() error path

[Abdun Nihaal]

When ngbe_sw_init() is called, memory is allocated for wx->rss_key
in wx_init_rss_key(). However, in ngbe_probe() function, the subsequent
error paths after ngbe_sw_init() don't free the rss_key. Fix that by
freeing it in error path along with wx->mac_table.

Also change the label to which execution jumps when ngbe_sw_init()
fails, because otherwise, it could lead to a double free for rss_key,
when the mac_table allocation fails in wx_sw_init().

Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
---
 drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
index a6159214ec0a..91b3055a5a9f 100644
--- a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
+++ b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
@@ -625,7 +625,7 @@ static int ngbe_probe(struct pci_dev *pdev,
 	/* setup the private structure */
 	err = ngbe_sw_init(wx);
 	if (err)
-		goto err_free_mac_table;
+		goto err_pci_release_regions;
 
 	/* check if flash load is done after hw power up */
 	err = wx_check_flash_load(wx, NGBE_SPI_ILDR_STATUS_PERST);
@@ -719,6 +719,7 @@ static int ngbe_probe(struct pci_dev *pdev,
 err_clear_interrupt_scheme:
 	wx_clear_interrupt_scheme(wx);
 err_free_mac_table:
+	kfree(wx->rss_key);
 	kfree(wx->mac_table);
 err_pci_release_regions:
 	pci_release_selected_regions(pdev,
-- 
2.47.2

Re: [PATCH net-next] net: ngbe: fix memory leak in ngbe_probe() error path

[Markus Elfring]

> When ngbe_sw_init() is called, memory is allocated for wx->rss_key
> in wx_init_rss_key(). However, in ngbe_probe() function, the subsequent
> error paths after ngbe_sw_init() don't free the rss_key. Fix that by
> freeing it in error path along with wx->mac_table.
>
> Also change the label to which execution jumps when ngbe_sw_init()
> fails, because otherwise, it could lead to a double free for rss_key,
> when the mac_table allocation fails in wx_sw_init().

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.15-rc1#n145

Regards,
Markus

Re: [PATCH net-next] net: ngbe: fix memory leak in ngbe_probe() error path

[Abdun Nihaal]

Hello Markus,

On Wed, Apr 09, 2025 at 05:23:39PM +0200, Markus Elfring wrote:
> How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
> https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.15-rc1#n145

Thanks for pointing that out. Actually I wasn't sure about which commit
to add as the Fixes tag, so I left it assuming that the maintainers
would know better.

I was confused between the following two commits both of which change
the kfree(wx->mac_table) line.
- 02338c484ab6 ("net: ngbe: Initialize sw info and register netdev")
- 9607a3e62645 ("net: wangxun: Rename private structure in libwx")

Regards,
Nihaal

Re: [PATCH net-next] net: ngbe: fix memory leak in ngbe_probe() error path

[Jakub Kicinski]

On Fri, 11 Apr 2025 10:44:55 +0530 Abdun Nihaal wrote:
> Hello Markus,
> 
> On Wed, Apr 09, 2025 at 05:23:39PM +0200, Markus Elfring wrote:
> > How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
> > https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.15-rc1#n145  
> 
> Thanks for pointing that out. Actually I wasn't sure about which commit
> to add as the Fixes tag, so I left it assuming that the maintainers
> would know better.
> 
> I was confused between the following two commits both of which change
> the kfree(wx->mac_table) line.
> - 02338c484ab6 ("net: ngbe: Initialize sw info and register netdev")
> - 9607a3e62645 ("net: wangxun: Rename private structure in libwx")

I think:

Fixes: 02338c484ab6 ("net: ngbe: Initialize sw info and register netdev")

rss_key gets allocated at that point but never freed. The later patches
just move it around and fix up a little but first broken patch counts.