netdev - Re: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251211014925.64457-1-enjuk@amazon.com>
Date: Thu, 11 Dec 2025 10:49:24 +0900
From: Kohei Enju <enjuk@...zon.com>
To: <jacob.e.keller@...el.com>
CC: <andrew+netdev@...n.ch>, <anthony.l.nguyen@...el.com>,
	<davem@...emloft.net>, <edumazet@...gle.com>, <enjuk@...zon.com>,
	<horms@...nel.org>, <intel-wired-lan@...ts.osuosl.org>,
	<jedrzej.jagielski@...el.com>, <kohei.enju@...il.com>, <kuba@...nel.org>,
	<mateusz.polchlopek@...el.com>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>, <przemyslaw.kitszel@...el.com>,
	<stefan.wegrzyn@...el.com>
Subject: Re: [Intel-wired-lan] [PATCH iwl-net v1] ixgbe: fix memory leaks in ixgbe_recovery_probe()

On Mon, 8 Dec 2025 17:14:28 -0800, Jacob Keller wrote:

> 
> 
>On 12/8/2025 9:06 AM, Simon Horman wrote:
>> On Sun, Dec 07, 2025 at 12:51:27AM +0900, Kohei Enju wrote:
>>> ixgbe_recovery_probe() does not free the following resources in its
>>> error path, unlike ixgbe_probe():
>>> - adapter->io_addr
>>> - adapter->jump_tables[0]
>>> - adapter->mac_table
>>> - adapter->rss_key
>>> - adapter->af_xdp_zc_qps
>>>
>>> The leaked MMIO region can be observed in /proc/vmallocinfo, and the
>>> remaining leaks are reported by kmemleak.
>>>
>>> Free these allocations and unmap the MMIO region on failure to avoid the
>>> leaks.
>>>
>>> Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode")
>>> Signed-off-by: Kohei Enju <enjuk@...zon.com>
>> 
>> Hi,
>> 
>> It seems that ixgbe_recovery_probe()  is only called from ixgbe_probe().
>> And that ixgbe_probe() already has an unwind ladder for these resources.
>> So I would suggest using that rather than replicating it
>> in ixgbe_recovery_probe. That is, have ixgbe_probe() unwind when
>> ixgbe_recovery_probe returns an error.
>
>Right. If resources are allocated by ixgbe_probe() they should be freed
>in ixgbe_probe() and not in ixgbe_recovery_probe() which is a smaller
>function called by ixgbe_probe() to enter recovery mode where only
>devlink flash update is enabled.
>
>It looks like most of these resources are allocated by probe and then
>ixgbe_recovery_probe() is called, which should instead let regular probe
>do cleanup for stuff it didn't setup itself.

That makes sense. I'll revise the patch and work on v2.

>
>> 
>> Also, maybe I'm wrong, but it seems that hw->aci.lock
>> is initialised more than once if ixgbe_recovery_probe() is called.
>> 
>
>Its initialized in ixgbe_sw_init, which is called before the
>ixgbe_recovery_probe, so yes that does look like a double initialization.

Good catch, I overlooked that. I'll address that as well.

Thank you for taking a look, Simon and Jacob.