[PATCH net v1] idpf: Fix vport IRQ name leak on request failure

[PATCH net v1] idpf: Fix vport IRQ name leak on request failure

[Yuho Choi]

idpf_vport_intr_req_irq() allocates a name for each vector IRQ before
calling request_irq(). On success, the name is released later through
kfree(free_irq()), but when request_irq() fails, the error path only
unwinds the previous vectors and the name for the failed one is leaked.

Free the allocated name on the request_irq() failure path, as done for
the mailbox IRQ in commit 9bff30482c10 ("idpf: Fix mailbox IRQ name leak
on request failure").

Fixes: bf9bf7042a38 ("idpf: avoid bloating &idpf_q_vector with big %NR_CPUS")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Compile-tested only (x86_64 defconfig + CONFIG_IDPF=m, W=1).

 drivers/net/ethernet/intel/idpf/idpf_txrx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
index 4311ffa30bb1..e7d5e7923371 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -4073,6 +4073,7 @@ static int idpf_vport_intr_req_irq(struct idpf_vport *vport,
 		if (err) {
 			netdev_err(vport->netdev,
 				   "Request_irq failed, error: %d\n", err);
+			kfree(name);
 			goto free_q_irqs;
 		}
 

base-commit: f0100363d8c374bd8e9ea7c9ba02744f0b802ca4
-- 
2.43.0

Re: [PATCH net v1] idpf: Fix vport IRQ name leak on request failure

[Simon Horman]

On Wed, Sep 23, 2026 at 07:48:06PM -0400, Yuho Choi wrote:
> idpf_vport_intr_req_irq() allocates a name for each vector IRQ before
> calling request_irq(). On success, the name is released later through
> kfree(free_irq()), but when request_irq() fails, the error path only
> unwinds the previous vectors and the name for the failed one is leaked.
> 
> Free the allocated name on the request_irq() failure path, as done for
> the mailbox IRQ in commit 9bff30482c10 ("idpf: Fix mailbox IRQ name leak
> on request failure").
> 
> Fixes: bf9bf7042a38 ("idpf: avoid bloating &idpf_q_vector with big %NR_CPUS")

I don't believe that commit introduced this problem.

> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
> ---
> Compile-tested only (x86_64 defconfig + CONFIG_IDPF=m, W=1).
> 
>  drivers/net/ethernet/intel/idpf/idpf_txrx.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> index 4311ffa30bb1..e7d5e7923371 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> @@ -4073,6 +4073,7 @@ static int idpf_vport_intr_req_irq(struct idpf_vport *vport,
>  		if (err) {
>  			netdev_err(vport->netdev,
>  				   "Request_irq failed, error: %d\n", err);
> +			kfree(name);

name is allocated by kasprintf() which is a wrapper around kvasprintf_const().
And kvasprintf_const() documents that it's return value should be freed
using kfree_const(). I don't think it will make any run-time difference
here, but perhaps it would be best to follow that convention.

Also, for completeness, shouldn't there be error handling for the case
where the allocation of name fails?

>  			goto free_q_irqs;
>  		}

Re: [PATCH net v1] idpf: Fix vport IRQ name leak on request failure

[Yuho Choi]

I appreciate your time to review this.

On Mon, 28 Sept 2026 at 05:15, Simon Horman <horms@kernel.org> wrote:
>
> > Fixes: bf9bf7042a38 ("idpf: avoid bloating &idpf_q_vector with big %NR_CPUS")
>
> I don't believe that commit introduced this problem.

Thanks for catching this. I'll fix this tag.

> name is allocated by kasprintf() which is a wrapper around kvasprintf_const().
> And kvasprintf_const() documents that it's return value should be freed
> using kfree_const(). I don't think it will make any run-time difference
> here, but perhaps it would be best to follow that convention.

kasprintf() uses kvasprintf(), not kvasprintf_const(), so the name is
always kmalloc'ed and kfree() matches the kfree(free_irq()) used on the
normal path. Please correct me if I'm wrong.

> Also, for completeness, shouldn't there be error handling for the case
> where the allocation of name fails?
>

Agreed, I'll add it in v2

Re: [PATCH net v1] idpf: Fix vport IRQ name leak on request failure

[Simon Horman]

On Wed, Sep 30, 2026 at 12:06:48PM -0400, Yuho Choi wrote:
> I appreciate your time to review this.
> 
> On Mon, 28 Sept 2026 at 05:15, Simon Horman <horms@kernel.org> wrote:
> >
> > > Fixes: bf9bf7042a38 ("idpf: avoid bloating &idpf_q_vector with big %NR_CPUS")
> >
> > I don't believe that commit introduced this problem.
> 
> Thanks for catching this. I'll fix this tag.
> 
> > name is allocated by kasprintf() which is a wrapper around kvasprintf_const().
> > And kvasprintf_const() documents that it's return value should be freed
> > using kfree_const(). I don't think it will make any run-time difference
> > here, but perhaps it would be best to follow that convention.
> 
> kasprintf() uses kvasprintf(), not kvasprintf_const(), so the name is
> always kmalloc'ed and kfree() matches the kfree(free_irq()) used on the
> normal path. Please correct me if I'm wrong.

Yes, of course you are right.
No idea how I managed to muddle that one up.
Sorry for the noise.

> 
> > Also, for completeness, shouldn't there be error handling for the case
> > where the allocation of name fails?
> >
> 
> Agreed, I'll add it in v2