[v1] rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()

[PATCH] rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()

Posted by Haoxiang Li 1 month, 3 weeks ago

When idtab allocation fails, net is not registered with rio_add_net()
yet, so kfree(net) is sufficient to release the memory.

Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
---
 drivers/rapidio/rio-scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index c12941f71e2c..03615eb2d3d7 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -854,7 +854,7 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport,
 
 		if (idtab == NULL) {
 			pr_err("RIO: failed to allocate destID table\n");
-			rio_free_net(net);
+			kfree(net);
 			net = NULL;
 		} else {
 			net->enum_data = idtab;
-- 
2.25.1

Re: [PATCH] rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()

Posted by Andrew Morton 2 weeks, 6 days ago

On Wed, 17 Dec 2025 17:15:48 +0800 Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> wrote:

> When idtab allocation fails, net is not registered with rio_add_net()
> yet, so kfree(net) is sufficient to release the memory.
> 
> Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>

Reviewed-by: Andrew Morton <akpm@linux-foundation.org>

> --- a/drivers/rapidio/rio-scan.c
> +++ b/drivers/rapidio/rio-scan.c
> @@ -854,7 +854,7 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport,
>  
>  		if (idtab == NULL) {
>  			pr_err("RIO: failed to allocate destID table\n");
> -			rio_free_net(net);
> +			kfree(net);
>  			net = NULL;
>  		} else {
>  			net->enum_data = idtab;

An existing issue I see: if this error path is taken, mport->net is
left pointing at freed memory.  I don't know if this is a bug, but it
seems sloppy.