On Wed, Sep 23, 2026 at 07:48:06PM -0400, Yuho Choi wrote:
> idpf_vport_intr_req_irq() allocates a name for each vector IRQ before
> calling request_irq(). On success, the name is released later through
> kfree(free_irq()), but when request_irq() fails, the error path only
> unwinds the previous vectors and the name for the failed one is leaked.
>
> Free the allocated name on the request_irq() failure path, as done for
> the mailbox IRQ in commit 9bff30482c10 ("idpf: Fix mailbox IRQ name leak
> on request failure").
>
> Fixes: bf9bf7042a38 ("idpf: avoid bloating &idpf_q_vector with big %NR_CPUS")
I don't believe that commit introduced this problem.
> Signed-off-by: Yuho Choi <[email protected]>
> ---
> Compile-tested only (x86_64 defconfig + CONFIG_IDPF=m, W=1).
>
> drivers/net/ethernet/intel/idpf/idpf_txrx.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> index 4311ffa30bb1..e7d5e7923371 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> @@ -4073,6 +4073,7 @@ static int idpf_vport_intr_req_irq(struct idpf_vport
> *vport,
> if (err) {
> netdev_err(vport->netdev,
> "Request_irq failed, error: %d\n", err);
> + kfree(name);
name is allocated by kasprintf() which is a wrapper around kvasprintf_const().
And kvasprintf_const() documents that it's return value should be freed
using kfree_const(). I don't think it will make any run-time difference
here, but perhaps it would be best to follow that convention.
Also, for completeness, shouldn't there be error handling for the case
where the allocation of name fails?
> goto free_q_irqs;
> }
