[PATCH net v2] bnxt: fix memory leak in bnxt_queue_mem_alloc error cases

[PATCH net v2] bnxt: fix memory leak in bnxt_queue_mem_alloc error cases

[Will Chen]

There is a small memory leak in bnxt_queue_mem_alloc:
when bnxt_alloc_rx_agg_bmap() succeeds
but bnxt_alloc_one_tpa_info() later fails,
the rx_agg_bmap allocated by bnxt_alloc_rx_agg_bmap()
is not freed in the fallthrough cleanup cases.

Free the rx_agg_bmap in the err_free_rx_agg_ring case
and initialize clone->rx_agg_bmap = NULL earlier in the function
to allow for safe fallthrough.

Fixes: bd649c5cc958 ("bnxt_en: handle tpa_info in queue API implementation")
Signed-off-by: Will Chen <will.chen.tty@gmail.com>
Reviewed-by: Joe Damato <joe@dama.to>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++
 1 file changed, 3 insertions(+)

 v2:
   - Rearrange the order of the frees as suggested by Michael

 v1: https://lore.kernel.org/netdev/20260728191146.1744825-1-will.chen.tty@gmail.com/

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 7513618793da..004ef99f4530 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -16217,6 +16217,7 @@ static int bnxt_queue_mem_alloc(struct net_device *dev,
 	clone->rx_next_cons = 0;
 	clone->need_head_pool = false;
 	clone->rx_page_size = qcfg->rx_page_size;
+	clone->rx_agg_bmap = NULL;
 
 	rc = bnxt_alloc_rx_page_pool(bp, clone, rxr->page_pool->p.nid);
 	if (rc)
@@ -16269,6 +16270,8 @@ static int bnxt_queue_mem_alloc(struct net_device *dev,
 	bnxt_free_one_tpa_info(bp, clone);
 err_free_rx_agg_ring:
 	bnxt_free_ring(bp, &clone->rx_agg_ring_struct.ring_mem);
+	kfree(clone->rx_agg_bmap);
+	clone->rx_agg_bmap = NULL;
 err_free_rx_ring:
 	bnxt_free_ring(bp, &clone->rx_ring_struct.ring_mem);
 err_rxq_info_unreg:

base-commit: 3f1f755366687d051174739fb99f7d560202f60b
-- 
2.53.0-Meta

Re: [PATCH net v2] bnxt: fix memory leak in bnxt_queue_mem_alloc error cases

[Michael Chan]

[-- Attachment #1: Type: text/plain, Size: 739 bytes --]

On Wed, Jul 29, 2026 at 3:01 PM Will Chen <will.chen.tty@gmail.com> wrote:
>
> There is a small memory leak in bnxt_queue_mem_alloc:
> when bnxt_alloc_rx_agg_bmap() succeeds
> but bnxt_alloc_one_tpa_info() later fails,
> the rx_agg_bmap allocated by bnxt_alloc_rx_agg_bmap()
> is not freed in the fallthrough cleanup cases.
>
> Free the rx_agg_bmap in the err_free_rx_agg_ring case
> and initialize clone->rx_agg_bmap = NULL earlier in the function
> to allow for safe fallthrough.
>
> Fixes: bd649c5cc958 ("bnxt_en: handle tpa_info in queue API implementation")
> Signed-off-by: Will Chen <will.chen.tty@gmail.com>
> Reviewed-by: Joe Damato <joe@dama.to>

Thanks.
Reviewed-by: Michael Chan <michael.chan@broadcom.com>

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5469 bytes --]