| Message ID | 20250415032910.13139-1-abdun.nihaal@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | b2727326d0a53709380aa147018085d71a6d4843 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: txgbe: fix memory leak in txgbe_probe() error path | expand |
On Tue, Apr 15, 2025 11:29 AM, Abdun Nihaal wrote: > When txgbe_sw_init() is called, memory is allocated for wx->rss_key > in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent > error paths after txgbe_sw_init() don't free the rss_key. Fix that by > freeing it in error path along with wx->mac_table. > > Also change the label to which execution jumps when txgbe_sw_init() > fails, because otherwise, it could lead to a double free for rss_key, > when the mac_table allocation fails in wx_sw_init(). > > Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number") > Reported-by: Jiawen Wu <jiawenwu@trustnetic.com> > Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com> > --- > drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c > index a2e245e3b016..38206a46693b 100644 > --- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c > +++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c > @@ -611,7 +611,7 @@ static int txgbe_probe(struct pci_dev *pdev, > /* setup the private structure */ > err = txgbe_sw_init(wx); > if (err) > - goto err_free_mac_table; > + goto err_pci_release_regions; > > /* check if flash load is done after hw power up */ > err = wx_check_flash_load(wx, TXGBE_SPI_ILDR_STATUS_PERST); > @@ -769,6 +769,7 @@ static int txgbe_probe(struct pci_dev *pdev, > wx_clear_interrupt_scheme(wx); > wx_control_hw(wx, false); > err_free_mac_table: > + kfree(wx->rss_key); > kfree(wx->mac_table); > err_pci_release_regions: > pci_release_selected_regions(pdev, > -- > 2.47.2 > Thanks. Reviewed-by: Jiawen Wu <jiawenwu@trustnetic.com>
On Tue, Apr 15, 2025 at 08:59:09AM +0530, Abdun Nihaal wrote: > When txgbe_sw_init() is called, memory is allocated for wx->rss_key > in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent > error paths after txgbe_sw_init() don't free the rss_key. Fix that by > freeing it in error path along with wx->mac_table. > > Also change the label to which execution jumps when txgbe_sw_init() > fails, because otherwise, it could lead to a double free for rss_key, > when the mac_table allocation fails in wx_sw_init(). > > Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number") > Reported-by: Jiawen Wu <jiawenwu@trustnetic.com> > Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Tue, 15 Apr 2025 08:59:09 +0530 you wrote: > When txgbe_sw_init() is called, memory is allocated for wx->rss_key > in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent > error paths after txgbe_sw_init() don't free the rss_key. Fix that by > freeing it in error path along with wx->mac_table. > > Also change the label to which execution jumps when txgbe_sw_init() > fails, because otherwise, it could lead to a double free for rss_key, > when the mac_table allocation fails in wx_sw_init(). > > [...] Here is the summary with links: - [net] net: txgbe: fix memory leak in txgbe_probe() error path https://git.kernel.org/netdev/net/c/b2727326d0a5 You are awesome, thank you!
diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c index a2e245e3b016..38206a46693b 100644 --- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c @@ -611,7 +611,7 @@ static int txgbe_probe(struct pci_dev *pdev, /* setup the private structure */ err = txgbe_sw_init(wx); if (err) - goto err_free_mac_table; + goto err_pci_release_regions; /* check if flash load is done after hw power up */ err = wx_check_flash_load(wx, TXGBE_SPI_ILDR_STATUS_PERST); @@ -769,6 +769,7 @@ static int txgbe_probe(struct pci_dev *pdev, wx_clear_interrupt_scheme(wx); wx_control_hw(wx, false); err_free_mac_table: + kfree(wx->rss_key); kfree(wx->mac_table); err_pci_release_regions: pci_release_selected_regions(pdev,
When txgbe_sw_init() is called, memory is allocated for wx->rss_key in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent error paths after txgbe_sw_init() don't free the rss_key. Fix that by freeing it in error path along with wx->mac_table. Also change the label to which execution jumps when txgbe_sw_init() fails, because otherwise, it could lead to a double free for rss_key, when the mac_table allocation fails in wx_sw_init(). Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number") Reported-by: Jiawen Wu <jiawenwu@trustnetic.com> Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com> --- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)