[RFT] net/netvsc: fix txd leak on chimney buffer alloc failure

Stephen Hemminger stephen at networkplumber.org
Thu Feb 19 02:44:44 CET 2026


Audit of tx_pkt_burst() code path in drivers found this related bug.

When hn_try_txagg() fails because hn_chim_alloc() cannot allocate a
chimney buffer slot, it returns NULL without freeing the txd descriptor
that was obtained earlier from the txd pool. The caller then breaks
out of the transmit loop without returning the txd either.

Each occurrence leaks one txd descriptor. Under sustained chimney
buffer pressure this eventually exhausts the txd pool and blocks
all transmit on the queue.

Add hn_txd_put() before the break to return the txd to the pool.

Fixes: 4e9c73e96e83 ("net/netvsc: add Hyper-V network device")
Cc: stable at dpdk.org

Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
---
 drivers/net/netvsc/hn_rxtx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
index 72dab26ede..3fc54e76b9 100644
--- a/drivers/net/netvsc/hn_rxtx.c
+++ b/drivers/net/netvsc/hn_rxtx.c
@@ -1595,8 +1595,10 @@ hn_xmit_pkts(void *ptxq, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 
 
 			pkt = hn_try_txagg(hv, txq, txd, pkt_size);
-			if (unlikely(!pkt))
+			if (unlikely(!pkt)) {
+				hn_txd_put(txq, txd);
 				break;
+			}
 
 			hn_encap(pkt, queue_id, m);
 			hn_append_to_chim(txq, pkt, m);
-- 
2.51.0



More information about the stable mailing list