[PATCH net] e1000: fix memory leak in e1000_probe()

[PATCH net] e1000: fix memory leak in e1000_probe()

[Dawei Feng]

In the e1000_probe() path, e1000_sw_init() allocates adapter->tx_ring and
adapter->rx_ring. If the subsequent CE4100-specific MDIO BAR mapping
fails, the error handling jumps past the ring cleanup code, leaking both
allocations.

Fix this leak by moving the err_mdio_ioremap label above the ring
deallocation logic. This guarantees the proper release of these resources
and prevents the memory leak.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc6.

An x86_64 allyesconfig build showed no new warnings. As we do not have a
CE4100 reference platform to test with, no runtime testing was able to
be performed.

Fixes: 5377a4160bb65 ("e1000: Add support for the CE4100 reference platform")
Cc: stable@vger.kernel.org
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
---
 drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 9b09eb144b81..d7f5c6f16142 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -1222,11 +1222,11 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	if (hw->flash_address)
 		iounmap(hw->flash_address);
+err_mdio_ioremap:
 	kfree(adapter->tx_ring);
 	kfree(adapter->rx_ring);
 err_dma:
 err_sw_init:
-err_mdio_ioremap:
 	iounmap(hw->ce4100_gbe_mdio_base_virt);
 	iounmap(hw->hw_addr);
 err_ioremap:
-- 
2.34.1

Re: [Intel-wired-lan] [PATCH net] e1000: fix memory leak in e1000_probe()

[Ruinskiy, Dima]

On 07/06/2026 17:57, Dawei Feng wrote:
> In the e1000_probe() path, e1000_sw_init() allocates adapter->tx_ring and
> adapter->rx_ring. If the subsequent CE4100-specific MDIO BAR mapping
> fails, the error handling jumps past the ring cleanup code, leaking both
> allocations.
> 
> Fix this leak by moving the err_mdio_ioremap label above the ring
> deallocation logic. This guarantees the proper release of these resources
> and prevents the memory leak.
> 
> The bug was first flagged by an experimental analysis tool we are
> developing for kernel memory-management bugs while analyzing
> v6.13-rc1. The tool is still under development and is not yet publicly
> available. Manual inspection confirms that the bug is still
> present in v7.1-rc6.
> 
> An x86_64 allyesconfig build showed no new warnings. As we do not have a
> CE4100 reference platform to test with, no runtime testing was able to
> be performed.
> 
> Fixes: 5377a4160bb65 ("e1000: Add support for the CE4100 reference platform")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
> Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
> ---
>   drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
> index 9b09eb144b81..d7f5c6f16142 100644
> --- a/drivers/net/ethernet/intel/e1000/e1000_main.c
> +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
> @@ -1222,11 +1222,11 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>   
>   	if (hw->flash_address)
>   		iounmap(hw->flash_address);
> +err_mdio_ioremap:
>   	kfree(adapter->tx_ring);
>   	kfree(adapter->rx_ring);
>   err_dma:
>   err_sw_init:
> -err_mdio_ioremap:
>   	iounmap(hw->ce4100_gbe_mdio_base_virt);
>   	iounmap(hw->hw_addr);
>   err_ioremap:
Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com>