Re: [PATCH v2 2/3] net: lan966x: fix page pool and resources leak in error paths

[Jakub Kicinski]

On Sat,  4 Apr 2026 00:07:13 +0100 David Carlier wrote:
> lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if
> the subsequent fdma_alloc_coherent() call fails, leaking the pool and
> leaving a dangling pointer in rx->page_pool.
> 
> Similarly, lan966x_fdma_init() frees the coherent DMA memory when
> lan966x_fdma_tx_alloc() fails but does not destroy the page pool that
> was successfully created by lan966x_fdma_rx_alloc(), leaking it.
> 
> Add the missing page_pool_destroy() calls in both error paths and
> NULL-out rx->page_pool after destruction to avoid a dangling pointer.

Okay...

> Fixes: 11871aba1974 ("net: lan96x: Use page_pool API")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: David Carlier <devnexen@xxxxxxxxx>
> ---
>  drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
> index 34bbcae2f068..b985ce64bb50 100644
> --- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
> +++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
> @@ -120,8 +120,11 @@ static int lan966x_fdma_rx_alloc(struct lan966x_rx *rx)
>  		return PTR_ERR(rx->page_pool);
>  
>  	err = fdma_alloc_coherent(lan966x->dev, fdma);
> -	if (err)
> +	if (err) {
> +		page_pool_destroy(rx->page_pool);
> +		rx->page_pool = NULL;
>  		return err;
> +	}
>  
>  	fdma_dcbs_init(fdma, FDMA_DCB_INFO_DATAL(fdma->db_size),
>  		       FDMA_DCB_STATUS_INTR);
> @@ -958,6 +961,7 @@ int lan966x_fdma_init(struct lan966x *lan966x)
>  	err = lan966x_fdma_tx_alloc(&lan966x->tx);
>  	if (err) {
>  		fdma_free_coherent(lan966x->dev, &lan966x->rx.fdma);
> +		page_pool_destroy(lan966x->rx.page_pool);

but here the "dangling pointer" is fine?
I don't care either way but be consistent.

>  		return err;
>  	}
>