From nobody Mon Jun 8 18:57:24 2026 Received: from mail-m155101.qiye.163.com (mail-m155101.qiye.163.com [101.71.155.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA0F98F7D; Wed, 27 May 2026 11:07:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=101.71.155.101 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779880044; cv=none; b=GxiGbKxG0ljZ6Z39z3VlJwEWYmJjj3s+IZc3a+y1WIhRo5G3ic2/JK4cq6v6U5sqCV+/avnMwHnTBWfM8459ggG6jdEJDsnKZaBHCA0D2oCJrDnjaUAPEznlzN9k0y8+VvtGqU1qyzxnXkrg0mT+PJizMj7pVPVPhb9YqxK4H2Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779880044; c=relaxed/simple; bh=tR2h7ZPXwFL6Np/Sen8hisfqQuCHkJ00R/Jk5VxMWmg=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=nQi8lu2APquUUWCZVUtcDr4YqeHHYfPGNec8ZNN+jaV8jWlNf1fAFe3OaBAr3j/Rtoc17vORZb/fjvNk1/CK9pv/vLhnlIltP8dcfZqe82fHRJZ0dpu0VpAJJynSTa6nrrLobDZNmyFuJjtPxz3U8PcDFduC8wke7PPKRLBD/UA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=fdcZNoyt; arc=none smtp.client-ip=101.71.155.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="fdcZNoyt" Received: from DESKTOP-SUEFNF9.taila7e912.ts.net (unknown [221.228.238.82]) by smtp.qiye.163.com (Hmail) with ESMTP id 400701e33; Wed, 27 May 2026 19:02:07 +0800 (GMT+08:00) From: Dawei Feng To: anthony.l.nguyen@intel.com Cc: przemyslaw.kitszel@intel.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, jesse.brandeburg@intel.com, sln@onemain.com, intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, jianhao.xu@seu.edu.cn, Dawei Feng , stable@vger.kernel.org, Zilin Guan Subject: [PATCH net] i40e: fix netdev leak in i40e_vsi_setup() error paths Date: Wed, 27 May 2026 19:02:05 +0800 Message-Id: <20260527110205.1780595-1-dawei.feng@seu.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0a9e6919500903a2kunmc4d7ecc43a9e3 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVlCHUNIVk5JQxpOHU9OSElDQlYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUpVSUlDVUlIQ1VDSVlXWRYaDxIVHRRZQVlPS0hVSktJSE 5DQ1VKS0tVS1kG DKIM-Signature: a=rsa-sha256; b=fdcZNoytiqVTMEEmwEnbmex0Y1AkGfokDoeVK/FAqs8BroYuQVbZIyOOzfT/pJthOVyQUWlIyEEASP8Nmw04wFHf6xUSq7xXW4U962Q3dBcgafEc8V7H2KxzWT+1HIbbJ68BvAt9ys/pEs7Po85jJSNJbEyLPGecLLWlQVQInkc=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=L4JvB8zmfLhyCH5RmecUwJB8gs5HNGzG6nxv4Q9PYZc=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" i40e_config_netdev() allocates vsi->netdev for main and VMDQ VSIs. If i40e_netif_set_realnum_tx_rx_queues(), i40e_devlink_create_port(), or register_netdev() fails, i40e_vsi_setup() goes to err_netdev without releasing the netdev. The existing cleanup only frees the netdev after a successful register_netdev(), so these error paths leak the allocation. Reorder the error paths at err_netdev to ensure proper cleanup of the allocated device. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc5. An x86_64 allyesconfig build showed no new warnings. As we do not have an Intel Ethernet Controller XL710 family adapter to test with, no runtime testing was able to be performed. Fixes: 41c445ff0f48 ("i40e: main driver core") Cc: stable@vger.kernel.org Signed-off-by: Zilin Guan Signed-off-by: Dawei Feng Reviewed-by: Aleksandr Loktionov Reviewed-by: Marcin Szycik --- drivers/net/ethernet/intel/i40e/i40e_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethe= rnet/intel/i40e/i40e_main.c index 6d4f9218dc68..1ced01b0cc09 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -14491,13 +14491,15 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *p= f, u8 type, if (vsi->netdev_registered) { vsi->netdev_registered =3D false; unregister_netdev(vsi->netdev); - free_netdev(vsi->netdev); - vsi->netdev =3D NULL; } err_dl_port: if (vsi->type =3D=3D I40E_VSI_MAIN) i40e_devlink_destroy_port(pf); err_netdev: + if (vsi->netdev) { + free_netdev(vsi->netdev); + vsi->netdev =3D NULL; + } i40e_aq_delete_element(&pf->hw, vsi->seid, NULL); err_vsi: i40e_vsi_clear(vsi); --=20 2.34.1