virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable()

The selftests added to our CI by Bui Quang Minh recently reveals
that there is a mem leak on the error path of virtnet_xsk_pool_enable():

unreferenced object 0xffff88800a68a000 (size 2048):
  comm "xdp_helper", pid 318, jiffies 4294692778
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    __kvmalloc_node_noprof+0x402/0x570
    virtnet_xsk_pool_enable+0x293/0x6a0 (drivers/net/virtio_net.c:5882)
    xp_assign_dev+0x369/0x670 (net/xdp/xsk_buff_pool.c:226)
    xsk_bind+0x6a5/0x1ae0
    __sys_bind+0x15e/0x230
    __x64_sys_bind+0x72/0xb0
    do_syscall_64+0xc1/0x1d0
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

Acked-by: Jason Wang <jasowang@redhat.com>
Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
Link: https://patch.msgid.link/20250430163836.3029761-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index b5549d542c022071249ea58ca255ae61eceeeece..f9e3e628ec4df9c2e2e4095a2a61122982f16d2a 100644 (file)
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -5890,8 +5890,10 @@ static int virtnet_xsk_pool_enable(struct net_device *dev,
 
        hdr_dma = virtqueue_dma_map_single_attrs(sq->vq, &xsk_hdr, vi->hdr_len,
                                                 DMA_TO_DEVICE, 0);
-       if (virtqueue_dma_mapping_error(sq->vq, hdr_dma))
-               return -ENOMEM;
+       if (virtqueue_dma_mapping_error(sq->vq, hdr_dma)) {
+               err = -ENOMEM;
+               goto err_free_buffs;
+       }
 
        err = xsk_pool_dma_map(pool, dma_dev, 0);
        if (err)
@@ -5919,6 +5921,8 @@ err_rq:
 err_xsk_map:
        virtqueue_dma_unmap_single_attrs(rq->vq, hdr_dma, vi->hdr_len,
                                         DMA_TO_DEVICE, 0);
+err_free_buffs:
+       kvfree(rq->xsk_buffs);
        return err;
 }