[PATCH] net/netvsc: fix event buffer leak on realloc failure

[Stephen Hemminger]

On Sun, 25 Oct 2026 01:46:33 +0000
Chen Zhao <ch3nzhao at gmail.com> wrote:

> rte_realloc() failure overwrites event_buf and leaks the old allocation.
> Save the old pointer and free it on failure before resetting event_sz.
> 
> Fixes: 1f2766b7ee02 ("net/netvsc: resize event buffer as needed")
> Cc: sthemmin at microsoft.com
> Cc: stable at dpdk.org
> Signed-off-by: Chen Zhao <ch3nzhao at gmail.com>
> ---

AI review says "good but it could be better"

On Sun, 25 Oct 2026 01:46:33 +0000
Chen Zhao <ch3nzhao at gmail.com> wrote:

> rte_realloc() failure overwrites event_buf and leaks the old allocation.
> Save the old pointer and free it on failure before resetting event_sz.

The leak is real, but freeing the old buffer is the wrong recovery.
The old buffer is still valid and usable for smaller events; there is
no reason to throw it away. Also event_sz is updated before the
allocation succeeds.

Use a temporary and only commit on success:

		if (unlikely(ret == -ENOBUFS)) {
			/* event buffer not large enough to read ring */
			uint32_t new_sz = len + len / 4;
			void *new_buf;

			PMD_DRV_LOG(DEBUG,
				    "event buffer expansion (need %u)", len);
			new_buf = rte_realloc(rxq->event_buf, new_sz,
					      RTE_CACHE_LINE_SIZE);
			if (new_buf == NULL)
				break;	/* out of memory, no more events now */

			rxq->event_buf = new_buf;
			rxq->event_sz = new_sz;
			goto retry;
		}

Drop the Cc to sthemmin at microsoft.com, that address is dead.