[PATCH net] mlxsw: spectrum_router: destroy FIB hash table on bind failure

[PATCH net] mlxsw: spectrum_router: destroy FIB hash table on bind failure

[Sang-Hoon Choi]

mlxsw_sp_fib_create() initializes fib->ht before binding the LPM tree.
If the bind fails, the error path releases the tree and frees fib without
destroying the initialized hash table, leaking its bucket allocation.

Destroy fib->ht on the post-initialization failure path.

Fixes: 2b52ce02e1d1 ("mlxsw: spectrum_router: Remove unnecessary prefix lengths from LPM tree")
Reported-by: Changyul Lee <lcy8047@gmail.com>
Assisted-by: LLM
Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
---
Compile-tested the affected object with x86_64 allmodconfig
and W=1 (GCC 13.3.0). Base: mainline 3b7cab693ba2bab63774bf5b988e8a61b2ef0f32.
No hardware testing or runtime failure reproduction was performed.

 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 3d6fdbab05e0..456c60b9be17 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -556,6 +556,7 @@ static struct mlxsw_sp_fib *mlxsw_sp_fib_create(struct mlxsw_sp *mlxsw_sp,
 
 err_lpm_tree_bind:
 	mlxsw_sp_lpm_tree_put(mlxsw_sp, lpm_tree);
+	rhashtable_destroy(&fib->ht);
 err_rhashtable_init:
 	kfree(fib);
 	return ERR_PTR(err);

Re: [PATCH net] mlxsw: spectrum_router: destroy FIB hash table on bind failure

[Ivan Vecera]

On October 2, 2026 9:47:40 PM GMT+02:00, Sang-Hoon Choi <csh0052@gmail.com> wrote:
>mlxsw_sp_fib_create() initializes fib->ht before binding the LPM tree.
>If the bind fails, the error path releases the tree and frees fib without
>destroying the initialized hash table, leaking its bucket allocation.
>
>Destroy fib->ht on the post-initialization failure path.
>
>Fixes: 2b52ce02e1d1 ("mlxsw: spectrum_router: Remove unnecessary prefix lengths from LPM tree")
>Reported-by: Changyul Lee <lcy8047@gmail.com>
>Assisted-by: LLM
>Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
>---
>Compile-tested the affected object with x86_64 allmodconfig
>and W=1 (GCC 13.3.0). Base: mainline 3b7cab693ba2bab63774bf5b988e8a61b2ef0f32.
>No hardware testing or runtime failure reproduction was performed.
>
> drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
>index 3d6fdbab05e0..456c60b9be17 100644
>--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
>+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
>@@ -556,6 +556,7 @@ static struct mlxsw_sp_fib *mlxsw_sp_fib_create(struct mlxsw_sp *mlxsw_sp,
> 
> err_lpm_tree_bind:
> 	mlxsw_sp_lpm_tree_put(mlxsw_sp, lpm_tree);
>+	rhashtable_destroy(&fib->ht);
> err_rhashtable_init:
> 	kfree(fib);
> 	return ERR_PTR(err);
>

Reviewed-by: Ivan Vecera <ivecera@redhat.com>

Re: [PATCH net] mlxsw: spectrum_router: destroy FIB hash table on bind failure

[Ido Schimmel]

On Fri, Oct 02, 2026 at 07:47:40PM +0000, Sang-Hoon Choi wrote:
> mlxsw_sp_fib_create() initializes fib->ht before binding the LPM tree.
> If the bind fails, the error path releases the tree and frees fib without
> destroying the initialized hash table, leaking its bucket allocation.
> 
> Destroy fib->ht on the post-initialization failure path.
> 
> Fixes: 2b52ce02e1d1 ("mlxsw: spectrum_router: Remove unnecessary prefix lengths from LPM tree")
> Reported-by: Changyul Lee <lcy8047@gmail.com>
> Assisted-by: LLM
> Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Re: [PATCH net] mlxsw: spectrum_router: destroy FIB hash table on bind failure

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 02 Oct 2026 19:47:40 +0000 you wrote:
> mlxsw_sp_fib_create() initializes fib->ht before binding the LPM tree.
> If the bind fails, the error path releases the tree and frees fib without
> destroying the initialized hash table, leaking its bucket allocation.
> 
> Destroy fib->ht on the post-initialization failure path.
> 
> Fixes: 2b52ce02e1d1 ("mlxsw: spectrum_router: Remove unnecessary prefix lengths from LPM tree")
> Reported-by: Changyul Lee <lcy8047@gmail.com>
> Assisted-by: LLM
> Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
> 
> [...]

Here is the summary with links:
  - [net] mlxsw: spectrum_router: destroy FIB hash table on bind failure
    https://git.kernel.org/netdev/net-next/c/a089139eb47b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html