Re: [PATCH net] bnxt: fix memory leak in bnxt_queue_mem_alloc error cases

[Michael Chan]

On Tue, Jul 28, 2026 at 12:11 PM Will Chen <will.chen.tty@xxxxxxxxx> wrote:
>
> There is a small memory leak in bnxt_queue_mem_alloc:
> when bnxt_alloc_rx_agg_bmap() succeeds
> but bnxt_alloc_one_tpa_info() later fails,
> the rx_agg_bmap allocated by bnxt_alloc_rx_agg_bmap()
> is not freed in the fallthrough cleanup cases.
>
> Simply free the rx_agg_bmap in the err_free_tpa_info case,
> as this is the only remaining error path where
> rx_agg_bmap is allocated and needs to be freed.
>
> Fixes: bd649c5cc958 ("bnxt_en: handle tpa_info in queue API implementation")
> Signed-off-by: Will Chen <will.chen.tty@xxxxxxxxx>
> ---
>  drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> index 7513618793da..c30507dd824e 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> @@ -16267,6 +16267,8 @@ static int bnxt_queue_mem_alloc(struct net_device *dev,
>
>  err_free_tpa_info:
>         bnxt_free_one_tpa_info(bp, clone);
> +       kfree(clone->rx_agg_bmap);
> +       clone->rx_agg_bmap = NULL;

I think logically, these 2 lines should be moved below under
err_free_rx_agg_ring because it is memory related to the agg ring.  We
may need to initialize clone->rx_agg_bmap = NULL near the top of the
function to be more complete.  Thanks.

>  err_free_rx_agg_ring:
>         bnxt_free_ring(bp, &clone->rx_agg_ring_struct.ring_mem);
>  err_free_rx_ring:
>

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature