[PATCH v1 5/7] net/iavf: fix hash flow metadata leaks

[Mandal, Anurag]

> -----Original Message-----
> From: Anatoly Burakov <anatoly.burakov at intel.com>
> Sent: 14 October 2026 20:49
> To: dev at dpdk.org
> Subject: [PATCH v1 5/7] net/iavf: fix hash flow metadata leaks
> 
> Hash flow parsing allocates RSS metadata, but validation has no callback to
> release it. Creation also leaks the metadata if rule allocation or the request to
> add the RSS rule fails.
> 
> Add a validation callback to release the parsed metadata, and free it on both
> creation failure paths. Parsing already checks the RSS inputs; validation does
> not add or remove a rule.
> 
> Fixes: 7be10c3004be ("net/iavf: add RSS configuration for VF")
> Fixes: 215a247b5f33 ("net/iavf: refactor hash flow")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
> ---
>  drivers/net/intel/iavf/iavf_hash.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/drivers/net/intel/iavf/iavf_hash.c
> b/drivers/net/intel/iavf/iavf_hash.c
> index cef30cd08e1..6787a380f8e 100644
> --- a/drivers/net/intel/iavf/iavf_hash.c
> +++ b/drivers/net/intel/iavf/iavf_hash.c
> @@ -80,6 +80,9 @@ iavf_hash_destroy(struct iavf_adapter *ad, struct
> rte_flow *flow,  static void  iavf_hash_uninit_parser(struct iavf_adapter *ad);
> static int
> +iavf_hash_validation(struct iavf_adapter *ad, struct rte_flow *flow,
> +		     void *meta, struct rte_flow_error *error); static int
>  iavf_hash_parse_pattern_action(struct iavf_adapter *ad,
>  			       struct iavf_pattern_match_item *array,
>  			       uint32_t array_len,
> @@ -680,6 +683,7 @@ static struct iavf_flow_engine iavf_hash_engine = {
>  	.create = iavf_hash_create,
>  	.destroy = iavf_hash_destroy,
>  	.uninit = iavf_hash_uninit_parser,
> +	.validation = iavf_hash_validation,
>  	.name = "hash",
>  	.type = IAVF_FLOW_ENGINE_HASH,
>  	.rule_size = sizeof(struct virtchnl_rss_cfg), @@ -1579,6 +1583,15 @@
> iavf_hash_parse_pattern_action(struct iavf_adapter *ad,
>  	return ret;
>  }
> 
> +static int
> +iavf_hash_validation(__rte_unused struct iavf_adapter *ad,
> +		     __rte_unused struct rte_flow *flow, void *meta,
> +		     __rte_unused struct rte_flow_error *error) {
> +	rte_free(meta);
> +	return 0;
> +}
> +
>  static int
>  iavf_hash_create(__rte_unused struct iavf_adapter *ad,
>  		 __rte_unused struct rte_flow *flow, void *meta, @@ -1594,6
> +1607,7 @@ iavf_hash_create(__rte_unused struct iavf_adapter *ad,
>  		rte_flow_error_set(error, EINVAL,
>  				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
>  				   "No memory for rss rule");
> +		rte_free(meta);
>  		return -ENOMEM;
>  	}
> 
> @@ -1609,6 +1623,7 @@ iavf_hash_create(__rte_unused struct iavf_adapter
> *ad,
>  				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
>  				   "Failed to add rss rule.");
>  		rte_free(rss_cfg);
> +		rte_free(meta);
>  		return -rte_errno;
>  	}
> 
> --
> 2.52.0

Hi Anatoly, 

I had submitted similar fix  in this patch earlier.
https://patches.dpdk.org/project/dpdk/patch/20261010121255.528329-1-anurag.mandal@intel.com/

Thanks,
Anurag M