[PATCH net] octeontx2-af: fix ng_rvu leak on repeated mailbox init

[PATCH net] octeontx2-af: fix ng_rvu leak on repeated mailbox init

[Ratheesh Kannoth]

From: Sai Krishna <saikrishnag@marvell.com>

rvu_mbox_init() allocates an ng_rvu object on every call and assigns
it to rvu->ng_rvu. The function is invoked separately for AF-PF
mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled,
so the first allocation is leaked when the second call overwrites the
pointer.

Allocate ng_rvu only once and reuse it across subsequent mailbox init
paths.

Fixes: e53ee4acb220 ("octeontx2-af: CN20k basic mbox operations and structures")
Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
---
 .../net/ethernet/marvell/octeontx2/af/rvu.c    | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
index ffba56ee8a60..5cef4903179a 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
@@ -2585,12 +2585,6 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,
 	if (!pf_bmap)
 		return -ENOMEM;
 
-	ng_rvu_mbox = kzalloc_obj(*ng_rvu_mbox);
-	if (!ng_rvu_mbox) {
-		err = -ENOMEM;
-		goto free_bitmap;
-	}
-
 	/* RVU VFs */
 	if (type == TYPE_AFVF)
 		bitmap_set(pf_bmap, 0, num);
@@ -2604,9 +2598,17 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,
 		}
 	}
 
-	rvu->ng_rvu = ng_rvu_mbox;
+	if (!rvu->ng_rvu) {
+		ng_rvu_mbox = kzalloc_obj(*ng_rvu_mbox);
+		if (!ng_rvu_mbox) {
+			err = -ENOMEM;
+			goto free_bitmap;
+		}
+
+		rvu->ng_rvu = ng_rvu_mbox;
 
-	rvu->ng_rvu->rvu_mbox_ops = &rvu_mbox_ops;
+		rvu->ng_rvu->rvu_mbox_ops = &rvu_mbox_ops;
+	}
 
 	err = cn20k_rvu_mbox_init(rvu, type, num);
 	if (err)
-- 
2.43.0

Re: [PATCH net] octeontx2-af: fix ng_rvu leak on repeated mailbox init

[Ratheesh Kannoth]

On 2026-08-20 at 11:06:56, Ratheesh Kannoth (rkannoth@marvell.com) wrote:
> From: Sai Krishna <saikrishnag@marvell.com>
>
> rvu_mbox_init() allocates an ng_rvu object on every call and assigns
> it to rvu->ng_rvu. The function is invoked separately for AF-PF
> mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled,
> so the first allocation is leaked when the second call overwrites the
> pointer.
>
> Allocate ng_rvu only once and reuse it across subsequent mailbox init
> paths.
>
> Fixes: e53ee4acb220 ("octeontx2-af: CN20k basic mbox operations and structures")
> Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>

Will address sashiko comments in v2.

pw-bot: changes-requested