[EXTERNAL] [RFT] net/netvsc: fix txd leak on chimney buffer alloc failure

[Long Li]

Thank you.

It seems we need to handle two additional early exits from the loop when hn_flush_txagg(), something like this?

diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
   index 72dab26ede..example 100644
   --- a/drivers/net/netvsc/hn_rxtx.c
   +++ b/drivers/net/netvsc/hn_rxtx.c
   @@ -1589,8 +1589,10 @@ hn_xmit_pkts(void *ptxq, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
                        if (txq->agg_pktleft == 0 ||
                            RTE_ALIGN(pkt_size, txq->agg_align) > txq->agg_szleft) {
   -                            if (hn_flush_txagg(txq, &need_sig))
   +                            if (hn_flush_txagg(txq, &need_sig)) {
   +                                    hn_txd_put(txq, txd);
                                        goto fail;
   +                            }
                        }


                        pkt = hn_try_txagg(hv, txq, txd, pkt_size);
   -                    if (unlikely(!pkt))
   +                    if (unlikely(!pkt)) {
   +                            hn_txd_put(txq, txd);
                                break;
   +                    }

                        hn_encap(pkt, queue_id, m);
   @@ -1611,8 +1615,10 @@ hn_xmit_pkts(void *ptxq, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
                } else {
                        /* Send any outstanding packets in buffer */
   -                    if (txq->agg_txd && hn_flush_txagg(txq, &need_sig))
   +                    if (txq->agg_txd && hn_flush_txagg(txq, &need_sig)) {
   +                            hn_txd_put(txq, txd);
                                goto fail;
   +                    }

                        pkt = txd->rndis_pkt;


> -----Original Message-----
> From: Stephen Hemminger <stephen at networkplumber.org>
> Sent: Wednesday, February 18, 2026 5:45 PM
> To: dev at dpdk.org
> Cc: Stephen Hemminger <stephen at networkplumber.org>; stable at dpdk.org;
> Long Li <longli at microsoft.com>; Wei Hu <weh at microsoft.com>; Haiyang
> Zhang <haiyangz at microsoft.com>
> Subject: [EXTERNAL] [RFT] net/netvsc: fix txd leak on chimney buffer alloc
> failure
> 
> Audit of tx_pkt_burst() code path in drivers found this related bug.
> 
> When hn_try_txagg() fails because hn_chim_alloc() cannot allocate a chimney
> buffer slot, it returns NULL without freeing the txd descriptor that was obtained
> earlier from the txd pool. The caller then breaks out of the transmit loop
> without returning the txd either.
> 
> Each occurrence leaks one txd descriptor. Under sustained chimney buffer
> pressure this eventually exhausts the txd pool and blocks all transmit on the
> queue.
> 
> Add hn_txd_put() before the break to return the txd to the pool.
> 
> Fixes: 4e9c73e96e83 ("net/netvsc: add Hyper-V network device")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
> ---
>  drivers/net/netvsc/hn_rxtx.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c index
> 72dab26ede..3fc54e76b9 100644
> --- a/drivers/net/netvsc/hn_rxtx.c
> +++ b/drivers/net/netvsc/hn_rxtx.c
> @@ -1595,8 +1595,10 @@ hn_xmit_pkts(void *ptxq, struct rte_mbuf
> **tx_pkts, uint16_t nb_pkts)
> 
> 
>  			pkt = hn_try_txagg(hv, txq, txd, pkt_size);
> -			if (unlikely(!pkt))
> +			if (unlikely(!pkt)) {
> +				hn_txd_put(txq, txd);
>  				break;
> +			}
> 
>  			hn_encap(pkt, queue_id, m);
>  			hn_append_to_chim(txq, pkt, m);
> --
> 2.51.0