[PATCH v4 net 2/4] net: hns3: fix page_pool leak in hns3_alloc_ring_memory error path

[Jijie Shao]

In hns3_alloc_ring_memory(), when hns3_alloc_ring_buffers() fails for
an RX ring, the error path jumps to out_with_desc, which frees the
descriptor ring but does not destroy the page_pool that was just
allocated by hns3_alloc_page_pool(). The page_pool and its pages are
leaked.

Destroy the page_pool in that error path as well. The pool is torn down
before the descriptor ring here, which is the opposite of the order in
hns3_fini_ring(); that is safe because hns3_alloc_ring_buffers() has
already detached every buffer it attached, so hns3_free_desc() walks
descriptors whose dma is zero and never hands a page back to the pool.

Fixes: 93188e9642c3 ("net: hns3: support skb's frag page recycling based on page pool")
Signed-off-by: Jijie Shao <shaojijie@xxxxxxxxxx>
---
Changes in v4:
  - Name hns3_fini_ring() instead of the non-existent
    hns3_free_ring_memory(), and drop "mirroring" because the destroy
    order differs.  The pool is destroyed before the descriptor ring
    here, which is safe because hns3_alloc_ring_buffers() has already
    detached every buffer.
v3: https://lore.kernel.org/all/20261030095633.377289-3-shaojijie@xxxxxxxxxx/
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 2f3aeade558c..dbf32c00bb7f 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -5078,6 +5078,8 @@ static int hns3_alloc_ring_memory(struct hns3_enet_ring *ring)
 	return 0;
 
 out_with_desc:
+	page_pool_destroy(ring->page_pool);
+	ring->page_pool = NULL;
 	hns3_free_desc(ring);
 out_with_desc_cb:
 	devm_kfree(ring_to_dev(ring), ring->desc_cb);
-- 
2.43.0