[PATCH] IB/hfi1: Fix potential leaks in IPoIB TX queue initialization

[PATCH] IB/hfi1: Fix potential leaks in IPoIB TX queue initialization

[Guangshuo Li]

When an SDMA header allocation fails, rollback skips the current TX
queue. Its ring and already allocated headers are leaked. Free the
partially initialized ring before unwinding the completed queues.

This issue was found by our static analysis tool under development.

Fixes: c874ad879c2f ("IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
 drivers/infiniband/hw/hfi1/ipoib_tx.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
index 8b9cc55db59d..2e9225b558b4 100644
--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
+++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
@@ -743,7 +743,7 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
 				kzalloc_node(sizeof(*tx->sdma_hdr),
 					     GFP_KERNEL, priv->dd->node);
 			if (!hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr)
-				goto free_txqs;
+				goto free_tx_ring;
 		}
 
 		netif_napi_add_tx(dev, &txq->napi, hfi1_ipoib_poll_tx_ring);
@@ -751,6 +751,10 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
 
 	return 0;
 
+free_tx_ring:
+	while (j--)
+		kfree(hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr);
+	kvfree(tx_ring->items);
 free_txqs:
 	for (i--; i >= 0; i--) {
 		struct hfi1_ipoib_txq *txq = &priv->txqs[i];

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4

Re: [PATCH] IB/hfi1: Fix potential leaks in IPoIB TX queue initialization

[Leon Romanovsky]

On Wed, Nov 11, 2026 at 08:23:19PM +0800, Guangshuo Li wrote:
> When an SDMA header allocation fails, rollback skips the current TX
> queue. Its ring and already allocated headers are leaked. Free the
> partially initialized ring before unwinding the completed queues.

free_tx_ring already performs that, see "for (j = 0; j < tx_ring_size; j++)"
loop.

Thanks

> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: c874ad879c2f ("IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init")
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
> ---
>  drivers/infiniband/hw/hfi1/ipoib_tx.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c
> index 8b9cc55db59d..2e9225b558b4 100644
> --- a/drivers/infiniband/hw/hfi1/ipoib_tx.c
> +++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c
> @@ -743,7 +743,7 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
>  				kzalloc_node(sizeof(*tx->sdma_hdr),
>  					     GFP_KERNEL, priv->dd->node);
>  			if (!hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr)
> -				goto free_txqs;
> +				goto free_tx_ring;
>  		}
>  
>  		netif_napi_add_tx(dev, &txq->napi, hfi1_ipoib_poll_tx_ring);
> @@ -751,6 +751,10 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv)
>  
>  	return 0;
>  
> +free_tx_ring:
> +	while (j--)
> +		kfree(hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr);
> +	kvfree(tx_ring->items);
>  free_txqs:
>  	for (i--; i >= 0; i--) {
>  		struct hfi1_ipoib_txq *txq = &priv->txqs[i];
> 
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
>