[PATCH] IB/hfi1: Fix potential leaks in IPoIB TX queue initialization
From: Guangshuo Li
Date: Wed Nov 11 2026 - 07:32:39 EST
When an SDMA header allocation fails, rollback skips the current TX
queue. Its ring and already allocated headers are leaked. Free the
partially initialized ring before unwinding the completed queues.
This issue was found by our static analysis tool under development.
Fixes: c874ad879c2f ("IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
drivers/infiniband/hw/hfi1/ipoib_tx.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
index 8b9cc55db59d..2e9225b558b4 100644
--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
+++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
@@ -743,7 +743,7 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
kzalloc_node(sizeof(*tx->sdma_hdr),
GFP_KERNEL, priv->dd->node);
if (!hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr)
- goto free_txqs;
+ goto free_tx_ring;
}
netif_napi_add_tx(dev, &txq->napi, hfi1_ipoib_poll_tx_ring);
@@ -751,6 +751,10 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
return 0;
+free_tx_ring:
+ while (j--)
+ kfree(hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr);
+ kvfree(tx_ring->items);
free_txqs:
for (i--; i >= 0; i--) {
struct hfi1_ipoib_txq *txq = &priv->txqs[i];
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4