[PATCH 1/7] net/ice: fix DDP package double free on init failure

Anurag Mandal anurag.mandal at intel.com
Tue Oct 27 11:51:31 CET 2026


When ice_init_hw_tbls() fails, ice_dev_init() frees the DDP package
copy but leaves hw->pkg_copy and hw->seg pointing into it. Without
safe mode, the error path then calls ice_deinit_hw(), which frees
the package copy again through ice_free_seg().

Use ice_free_seg(), which also clears these pointers.

Fixes: 9c4f15901ada ("net/ice: free memory with matching allocator")

Signed-off-by: Anurag Mandal <anurag.mandal at intel.com>
---
 drivers/net/intel/ice/ice_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/intel/ice/ice_ethdev.c b/drivers/net/intel/ice/ice_ethdev.c
index b846555b97..dd3a4976ab 100644
--- a/drivers/net/intel/ice/ice_ethdev.c
+++ b/drivers/net/intel/ice/ice_ethdev.c
@@ -2785,7 +2785,7 @@ ice_dev_init(struct rte_eth_dev *dev)
 		ret = ice_init_hw_tbls(hw);
 		if (ret) {
 			PMD_INIT_LOG(ERR, "ice_init_hw_tbls failed: %d", ret);
-			ice_free(hw, hw->pkg_copy);
+			ice_free_seg(hw);
 		}
 	}
 
-- 
2.25.1



More information about the dev mailing list