net: txgbe: fix memory leak in txgbe_probe() error path

[PATCH net] net: txgbe: fix memory leak in txgbe_probe() error path

Posted by Abdun Nihaal 8 months, 1 week ago

When txgbe_sw_init() is called, memory is allocated for wx->rss_key
in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent
error paths after txgbe_sw_init() don't free the rss_key. Fix that by
freeing it in error path along with wx->mac_table.

Also change the label to which execution jumps when txgbe_sw_init()
fails, because otherwise, it could lead to a double free for rss_key,
when the mac_table allocation fails in wx_sw_init().

Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number")
Reported-by: Jiawen Wu <jiawenwu@trustnetic.com>
Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
---
 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
index a2e245e3b016..38206a46693b 100644
--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
@@ -611,7 +611,7 @@ static int txgbe_probe(struct pci_dev *pdev,
 	/* setup the private structure */
 	err = txgbe_sw_init(wx);
 	if (err)
-		goto err_free_mac_table;
+		goto err_pci_release_regions;
 
 	/* check if flash load is done after hw power up */
 	err = wx_check_flash_load(wx, TXGBE_SPI_ILDR_STATUS_PERST);
@@ -769,6 +769,7 @@ static int txgbe_probe(struct pci_dev *pdev,
 	wx_clear_interrupt_scheme(wx);
 	wx_control_hw(wx, false);
 err_free_mac_table:
+	kfree(wx->rss_key);
 	kfree(wx->mac_table);
 err_pci_release_regions:
 	pci_release_selected_regions(pdev,
-- 
2.47.2

Re: [PATCH net] net: txgbe: fix memory leak in txgbe_probe() error path

Posted by Simon Horman 8 months ago

On Tue, Apr 15, 2025 at 08:59:09AM +0530, Abdun Nihaal wrote:
> When txgbe_sw_init() is called, memory is allocated for wx->rss_key
> in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent
> error paths after txgbe_sw_init() don't free the rss_key. Fix that by
> freeing it in error path along with wx->mac_table.
> 
> Also change the label to which execution jumps when txgbe_sw_init()
> fails, because otherwise, it could lead to a double free for rss_key,
> when the mac_table allocation fails in wx_sw_init().
> 
> Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number")
> Reported-by: Jiawen Wu <jiawenwu@trustnetic.com>
> Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

RE: [PATCH net] net: txgbe: fix memory leak in txgbe_probe() error path

Posted by Jiawen Wu 8 months, 1 week ago

On Tue, Apr 15, 2025 11:29 AM, Abdun Nihaal wrote:
> When txgbe_sw_init() is called, memory is allocated for wx->rss_key
> in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent
> error paths after txgbe_sw_init() don't free the rss_key. Fix that by
> freeing it in error path along with wx->mac_table.
> 
> Also change the label to which execution jumps when txgbe_sw_init()
> fails, because otherwise, it could lead to a double free for rss_key,
> when the mac_table allocation fails in wx_sw_init().
> 
> Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number")
> Reported-by: Jiawen Wu <jiawenwu@trustnetic.com>
> Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
> ---
>  drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
> index a2e245e3b016..38206a46693b 100644
> --- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
> +++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
> @@ -611,7 +611,7 @@ static int txgbe_probe(struct pci_dev *pdev,
>  	/* setup the private structure */
>  	err = txgbe_sw_init(wx);
>  	if (err)
> -		goto err_free_mac_table;
> +		goto err_pci_release_regions;
> 
>  	/* check if flash load is done after hw power up */
>  	err = wx_check_flash_load(wx, TXGBE_SPI_ILDR_STATUS_PERST);
> @@ -769,6 +769,7 @@ static int txgbe_probe(struct pci_dev *pdev,
>  	wx_clear_interrupt_scheme(wx);
>  	wx_control_hw(wx, false);
>  err_free_mac_table:
> +	kfree(wx->rss_key);
>  	kfree(wx->mac_table);
>  err_pci_release_regions:
>  	pci_release_selected_regions(pdev,
> --
> 2.47.2
> 

Thanks.

Reviewed-by: Jiawen Wu <jiawenwu@trustnetic.com>