[PATCH] net: hns3: destroy the page pool if RX buffer allocation fails

[Wentao Liang]

hns3_alloc_ring_memory() creates the page pool and then fills the RX
ring with buffers from it. If filling the ring fails, the error path
only frees the descriptors and the descriptor callbacks, so the page
pool created a moment earlier is leaked.

The page pool is normally destroyed by hns3_fini_ring(), but
hns3_init_all_ring() only cleans up the rings that were set up before
the failing one, so the pool of the failing ring is never released.

Destroy the page pool on the buffer allocation failure path too.

Fixes: 93188e9642c3 ("net: hns3: support skb's frag page recycling based on page pool")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 47788be64be6..fe339ddc6379 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -5073,6 +5073,10 @@ static int hns3_alloc_ring_memory(struct hns3_enet_ring *ring)
 
 out_with_desc:
 	hns3_free_desc(ring);
+	if (ring->page_pool) {
+		page_pool_destroy(ring->page_pool);
+		ring->page_pool = NULL;
+	}
 out_with_desc_cb:
 	devm_kfree(ring_to_dev(ring), ring->desc_cb);
 	ring->desc_cb = NULL;
-- 
2.34.1