linux-kernel - Re: [PATCH net 1/1] octeontx2-af: CGX: fix bitmap leaks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ba2c3143-0761-4903-ac0e-88ca502b4e50@mboxify.com>
Date: Thu, 5 Feb 2026 21:35:29 +0800
From: Bo Sun <bo@...xify.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: pabeni@...hat.com, sgoutham@...vell.com, lcherian@...vell.com,
 gakula@...vell.com, jerinj@...vell.com, hkelam@...vell.com,
 sbhatta@...vell.com, andrew+netdev@...n.ch, davem@...emloft.net,
 edumazet@...gle.com, netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
 stable@...r.kernel.org
Subject: Re: [PATCH net 1/1] octeontx2-af: CGX: fix bitmap leaks

On 10/23/2025 9:22 AM, Jakub Kicinski wrote:
> On Mon, 20 Oct 2025 22:31:12 +0800 Bo Sun wrote:
>> The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)
>> are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().
>> Unbinding and rebinding the driver therefore triggers kmemleak:
>>
>>      unreferenced object (size 16):
>>          backtrace:
>>            rvu_alloc_bitmap
>>            cgx_probe
>>
>> Free both bitmaps during teardown.
>>
>> Fixes: e740003874ed ("octeontx2-af: Flow control resource management")
>> Cc: stable@...r.kernel.org
>> Signed-off-by: Bo Sun <bo@...xify.com>
> 
> Looks like rvu_free_bitmap() exists. We should probably use it?

Apologies for the late reply.
You're right that rvu_free_bitmap() exists. I stayed with direct kfree()
for consistency with the existing code in cgx_lmac_exit(), because which
already uses kfree(lmac->mac_to_index_bmap.bmap).

That said, I'm OK with either way:
1. Keep kfree() to match the existing pattern in this function
2. Switch all three bitmap frees (including mac_to_index_bmap) to use
rvu_free_bitmap() for consistency with the alloc/free API pairing

What's your preference?

Thanks,
Bo

> 
>> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
>> index ec0e11c77cbf..f56e6782c4de 100644
>> --- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
>> +++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
>> @@ -1823,6 +1823,8 @@ static int cgx_lmac_exit(struct cgx *cgx)
>>   		cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, false);
>>   		cgx_configure_interrupt(cgx, lmac, lmac->lmac_id, true);
>>   		kfree(lmac->mac_to_index_bmap.bmap);
>> +		kfree(lmac->rx_fc_pfvf_bmap.bmap);
>> +		kfree(lmac->tx_fc_pfvf_bmap.bmap);
>>   		kfree(lmac->name);
>>   		kfree(lmac);
>>   	}