Re: [PATCH] net: hns3: destroy the page pool if RX buffer allocation fails

[Simon Horman <horms@kernel.org>]

On Tue, Nov 03, 2026 at 10:05:33AM +0000, Wentao Liang wrote:
> hns3_alloc_ring_memory() creates the page pool and then fills the RX
> ring with buffers from it. If filling the ring fails, the error path
> only frees the descriptors and the descriptor callbacks, so the page
> pool created a moment earlier is leaked.
> 
> The page pool is normally destroyed by hns3_fini_ring(), but
> hns3_init_all_ring() only cleans up the rings that were set up before
> the failing one, so the pool of the failing ring is never released.
> 
> Destroy the page pool on the buffer allocation failure path too.
> 
> Fixes: 93188e9642c3 ("net: hns3: support skb's frag page recycling based on page pool")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
> index 47788be64be6..fe339ddc6379 100644
> --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
> +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
> @@ -5073,6 +5073,10 @@ static int hns3_alloc_ring_memory(struct hns3_enet_ring *ring)
>  
>  out_with_desc:
>  	hns3_free_desc(ring);
> +	if (ring->page_pool) {
> +		page_pool_destroy(ring->page_pool);
> +		ring->page_pool = NULL;
> +	}

The condition is not necessary as as page_pool_destroy is a no-op when
passed NULL. Please remove it to simplify the code-flow.

>  out_with_desc_cb:
>  	devm_kfree(ring_to_dev(ring), ring->desc_cb);
>  	ring->desc_cb = NULL;
> -- 
> 2.34.1

You will also need to answer the questions about providence posed by the
bot. Ideally in the patch description if you post a v2.

-- 
pw-bot: changes-requested