Re: [net-next] net: hwbm: fix buffer leak when construct callback is missing

[Jakub Kicinski <kuba@kernel.org>]

On Thu, 21 May 2026 18:16:18 +0800 Chenguang Zhao wrote:
> hwbm_pool_refill() could allocate a buffer and return success without
> calling construct(), leaking the buffer and letting hwbm_pool_add()
> incorrectly increment buf_num.
> 
> Free the buffer and return -EINVAL if construct is NULL.

This code would make no sense if ->construct is NULL right?
If you want to touch this code you should remove all the checks
if ->construct is NULL instead. All in-tree callers (obviously)
set it to a valid callback.

> diff --git a/net/core/hwbm.c b/net/core/hwbm.c
> index ac1a66df9adc..284b97c488dc 100644
> --- a/net/core/hwbm.c
> +++ b/net/core/hwbm.c
> @@ -33,11 +33,15 @@ int hwbm_pool_refill(struct hwbm_pool *bm_pool, gfp_t gfp)
>  	if (!buf)
>  		return -ENOMEM;
>  
> -	if (bm_pool->construct)
> -		if (bm_pool->construct(bm_pool, buf)) {
> -			hwbm_buf_free(bm_pool, buf);
> -			return -ENOMEM;
> -		}
> +	if (!bm_pool->construct) {
> +		hwbm_buf_free(bm_pool, buf);
> +		return -EINVAL;
> +	}
> +
> +	if (bm_pool->construct(bm_pool, buf)) {
> +		hwbm_buf_free(bm_pool, buf);
> +		return -ENOMEM;
> +	}
>  
>  	return 0;
>  }
-- 
pw-bot: cr