On Thu, Nov 05, 2026 at 09:47:18AM +0000, Anurag Mandal wrote:
> ice_dcf_init_hw() never frees the VF VSI map on its error paths,
> so it leaks when any step after getting the map fails.
>
> Similarly, when getting the VLAN offload V2 capabilities fails,
> the error path leaves the interrupt callback registered and
> enabled, and leaks the QoS bandwidth config array.
> As the DCF hardware structure passed to the callback is freed
> with the port when probe fails, a later interrupt would use
> freed memory.
>
> Free the VSI map, and add an error label that disables the
> interrupt, unregisters the callback and frees the QoS array.
>
> Fixes: 9a7980cfdf67 ("net/ice: complete VLAN offload capability for DCF")
> Fixes: 8e1cf1823191 ("net/ice: init RSS and supported RXDID in DCF")
> Fixes: 7564d5509611 ("net/ice: add DCF hardware initialization")
> Cc: [email protected]
>
> Signed-off-by: Anurag Mandal <[email protected]>
> ---
> drivers/net/intel/ice/ice_dcf.c | 11 ++++++++++-
> 1 file changed, 10 insertions(+), 1 deletion(-)
>
Acked-by: Bruce Richardson <[email protected]>
One comment inline below. [I can fix on apply if no other issues with the
set]
> diff --git a/drivers/net/intel/ice/ice_dcf.c b/drivers/net/intel/ice/ice_dcf.c
> index 976f2ed260..d87655c11d 100644
> --- a/drivers/net/intel/ice/ice_dcf.c
> +++ b/drivers/net/intel/ice/ice_dcf.c
> @@ -853,14 +853,23 @@ ice_dcf_init_hw(struct rte_eth_dev *eth_dev, struct
> ice_dcf_hw *hw)
>
> if ((hw->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN_V2) &&
> dcf_get_vlan_offload_caps_v2(hw))
> - goto err_rss;
> + goto err_intr;
>
> return 0;
>
> +err_intr:
> + ice_dcf_disable_irq0(hw);
> + rte_intr_disable(pci_dev->intr_handle);
> + rte_intr_callback_unregister(pci_dev->intr_handle,
> + ice_dcf_dev_interrupt_handler, hw);
AI review points out that this would be better using unregister_sync rather
than just unregister.
> + rte_free(hw->qos_bw_cfg);
> + hw->qos_bw_cfg = NULL;
> err_rss:
> rte_free(hw->rss_key);
> rte_free(hw->rss_lut);
> err_alloc:
> + rte_free(hw->vf_vsi_map);
> + hw->vf_vsi_map = NULL;
> rte_free(hw->vf_res);
> err_api:
> iavf_shutdown_adminq(&hw->avf);
> --
> 2.25.1
>
