mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Jijie Shao <shaojijie@huawei.com>
To: Simon Horman <horms@kernel.org>, Wentao Liang <vulab@iscas.ac.cn>
Cc: <shaojijie@huawei.com>, Jian Shen <shenjian15@huawei.com>,
	Andrew Lunn <andrew+netdev@lunn.ch>,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@kernel.org>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	<netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	<stable@vger.kernel.org>
Subject: Re: [PATCH] net: hns3: destroy the page pool if RX buffer allocation fails
Date: Mon, 9 Nov 2026 11:53:33 +0800	[thread overview]
Message-ID: <e4ce40a0-2bcc-4be9-8697-797c84275cc7@huawei.com> (raw)
In-Reply-To: <20261106180307.GM865646@horms.kernel.org>


on 2026/11/7 2:03, Simon Horman wrote:
> On Tue, Nov 03, 2026 at 10:05:33AM +0000, Wentao Liang wrote:
>> hns3_alloc_ring_memory() creates the page pool and then fills the RX
>> ring with buffers from it. If filling the ring fails, the error path
>> only frees the descriptors and the descriptor callbacks, so the page
>> pool created a moment earlier is leaked.
>>
>> The page pool is normally destroyed by hns3_fini_ring(), but
>> hns3_init_all_ring() only cleans up the rings that were set up before
>> the failing one, so the pool of the failing ring is never released.
>>
>> Destroy the page pool on the buffer allocation failure path too.
>>
>> Fixes: 93188e9642c3 ("net: hns3: support skb's frag page recycling based on page pool")
>> Cc: stable@vger.kernel.org
>> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
>> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
>> ---
>>   drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
>> index 47788be64be6..fe339ddc6379 100644
>> --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
>> +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
>> @@ -5073,6 +5073,10 @@ static int hns3_alloc_ring_memory(struct hns3_enet_ring *ring)
>>   
>>   out_with_desc:
>>   	hns3_free_desc(ring);
>> +	if (ring->page_pool) {
>> +		page_pool_destroy(ring->page_pool);
>> +		ring->page_pool = NULL;
>> +	}
> The condition is not necessary as as page_pool_destroy is a no-op when
> passed NULL. Please remove it to simplify the code-flow.

Hi Simon, Wentao,

Agreed, good catch. I am fixing the same leak in my series:
   https://lore.kernel.org/all/20261030095633.377289-3-shaojijie@huawei.com/

My v3 had the same redundant guard, and v4 will drop it, since
page_pool_destroy() already handles NULL and out_with_desc is only
reachable from the RX branch.

Wentao, thanks for your work on this and for tracking down the
duplicate. Sorry you had to withdraw it.

Thanks,
Jijie Shao



      parent reply	other threads:[~2026-11-09  3:53 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-03 10:05 Wentao Liang
2026-11-03 10:10 ` netdev-bot+sinfo
2026-11-03 10:25 ` Krzysztof Kozlowski
2026-11-06 18:03 ` Simon Horman
2026-11-07  6:40   ` Wentao Liang
2026-11-09  3:53   ` Jijie Shao [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=e4ce40a0-2bcc-4be9-8697-797c84275cc7@huawei.com \
    --to=shaojijie@huawei.com \
    --cc=andrew+netdev@lunn.ch \
    --cc=davem@davemloft.net \
    --cc=edumazet@kernel.org \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=shenjian15@huawei.com \
    --cc=stable@vger.kernel.org \
    --cc=vulab@iscas.ac.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®