otx2_cptpf_probe() allocates MSI-X vectors with pci_alloc_irq_vectors()
before initializing the AF-PF mailbox, registering mailbox interrupts
and setting up the PF device.

When cptpf_afpf_mbox_init(), cptpf_register_afpf_mbox_intr(),
cptpf_device_init(), cn10k_cptpf_lmtst_init(),
otx2_cpt_init_eng_grps(), sysfs_create_group() or
otx2_cpt_register_dl() fails after IRQ vectors have been allocated
successfully, the function unwinds mailbox, interrupt and engine group
state, but fails to free the allocated IRQ vectors.

The issue was identified by a static analysis tool I developed and
confirmed by manual review. Add a dedicated error path to call
pci_free_irq_vectors() after pci_alloc_irq_vectors() succeeds.

Fixes: 83ffcf78627f ("crypto: octeontx2 - add mailbox communication with AF")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
index 346d1345f11c..059f702dbf5c 100644
--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
+++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
@@ -783,7 +783,7 @@ static int otx2_cptpf_probe(struct pci_dev *pdev,
 	/* Initialize AF-PF mailbox */
 	err = cptpf_afpf_mbox_init(cptpf);
 	if (err)
-		goto clear_drvdata;
+		goto free_irq_vectors;
 	/* Register mailbox interrupt */
 	err = cptpf_register_afpf_mbox_intr(cptpf);
 	if (err)
@@ -826,6 +826,8 @@ static int otx2_cptpf_probe(struct pci_dev *pdev,
 	cptpf_disable_afpf_mbox_intr(cptpf);
 destroy_afpf_mbox:
 	cptpf_afpf_mbox_destroy(cptpf);
+free_irq_vectors:
+	pci_free_irq_vectors(pdev);
 clear_drvdata:
 	pci_set_drvdata(pdev, NULL);
 	return err;
-- 
2.43.0

On Tue, Apr 14, 2026 at 08:38:57PM +0800, Guangshuo Li wrote:
>
> diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
> index 346d1345f11c..059f702dbf5c 100644
> --- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
> +++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c
> @@ -783,7 +783,7 @@ static int otx2_cptpf_probe(struct pci_dev *pdev,
>  	/* Initialize AF-PF mailbox */
>  	err = cptpf_afpf_mbox_init(cptpf);
>  	if (err)
> -		goto clear_drvdata;
> +		goto free_irq_vectors;
>  	/* Register mailbox interrupt */
>  	err = cptpf_register_afpf_mbox_intr(cptpf);
>  	if (err)
> @@ -826,6 +826,8 @@ static int otx2_cptpf_probe(struct pci_dev *pdev,
>  	cptpf_disable_afpf_mbox_intr(cptpf);
>  destroy_afpf_mbox:
>  	cptpf_afpf_mbox_destroy(cptpf);
> +free_irq_vectors:
> +	pci_free_irq_vectors(pdev);

Good catch.  But what about the remove path, shouldn't the vectors
be freed there as well?

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Hi Herbert,

Thanks for the review.

On Thu, 16 Apr 2026 at 17:20, Herbert Xu <herbert@gondor.apana.org.au> wrote:
>
> Good catch.  But what about the remove path, shouldn't the vectors
> be freed there as well?
>
> Thanks,
> --

I investigated this further after your comment and found that this
driver relies on the PCI managed cleanup associated with
pcim_enable_device(). In other words, the IRQ vectors allocated by
pci_alloc_irq_vectors() are already reclaimed through that path, so an
explicit pci_free_irq_vectors() is not needed in remove/error unwind
here.

So this patch is not needed. I'll drop it.

Thanks,
Guangshuo