netdev - Re: [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aTcFhoH-z2btEKT-@horms.kernel.org>
Date: Mon, 8 Dec 2025 17:06:14 +0000
From: Simon Horman <horms@...nel.org>
To: Kohei Enju <enjuk@...zon.com>
Cc: intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
	Tony Nguyen <anthony.l.nguyen@...el.com>,
	Przemek Kitszel <przemyslaw.kitszel@...el.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Jedrzej Jagielski <jedrzej.jagielski@...el.com>,
	Mateusz Polchlopek <mateusz.polchlopek@...el.com>,
	Stefan Wegrzyn <stefan.wegrzyn@...el.com>, kohei.enju@...il.com
Subject: Re: [PATCH iwl-net v1] ixgbe: fix memory leaks in
 ixgbe_recovery_probe()

On Sun, Dec 07, 2025 at 12:51:27AM +0900, Kohei Enju wrote:
> ixgbe_recovery_probe() does not free the following resources in its
> error path, unlike ixgbe_probe():
> - adapter->io_addr
> - adapter->jump_tables[0]
> - adapter->mac_table
> - adapter->rss_key
> - adapter->af_xdp_zc_qps
> 
> The leaked MMIO region can be observed in /proc/vmallocinfo, and the
> remaining leaks are reported by kmemleak.
> 
> Free these allocations and unmap the MMIO region on failure to avoid the
> leaks.
> 
> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode")
> Signed-off-by: Kohei Enju <enjuk@...zon.com>

Hi,

It seems that ixgbe_recovery_probe()  is only called from ixgbe_probe().
And that ixgbe_probe() already has an unwind ladder for these resources.
So I would suggest using that rather than replicating it
in ixgbe_recovery_probe. That is, have ixgbe_probe() unwind when
ixgbe_recovery_probe returns an error.

Also, maybe I'm wrong, but it seems that hw->aci.lock
is initialised more than once if ixgbe_recovery_probe() is called.

...