patch 'ipc: fix memory leaks on async request partial failure' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/05/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/db041ce7076499d995bbb9245d1e14c9135606a2

Thanks.

Luca Boccassi

---
>From db041ce7076499d995bbb9245d1e14c9135606a2 Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Fri, 26 Jun 2026 11:33:59 +0100
Subject: [PATCH] ipc: fix memory leaks on async request partial failure

[ upstream commit b901af4f0cacfc6eba6836299fdd416814dbe29e ]

When rte_mp_request_async() fails to send requests to all peers,
copy and param can lose ownership and leak.

However, we cannot simply free them unconditionally, as "partial failure"
means some requests were already queued and thus still reference `copy` and
`param`, so freeing them directly on the error path can cause
use-after-free when those requests are later handled by the async timeout.

Fix this by rolling back queued requests from the current batch, and reset
nb_sent to 0. Freeing the requests is now safe even if some requests were
sent, as any responses or timeouts will not find the request ID in the
queue and will safely exit without doing anything.

Coverity issue: 501503
Fixes: f05e26051c15 ("eal: add IPC asynchronous request")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
---
 lib/eal/common/eal_common_proc.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/lib/eal/common/eal_common_proc.c b/lib/eal/common/eal_common_proc.c
index 15ad3f6448..fb7220dd2c 100644
--- a/lib/eal/common/eal_common_proc.c
+++ b/lib/eal/common/eal_common_proc.c
@@ -1218,6 +1218,28 @@ rte_mp_request_async(struct rte_mp_msg *req, const struct timespec *ts,
 		if (mp_request_async(path, copy, param, ts))
 			ret = -1;
 	}
+
+	/*
+	 * On partial failure, roll back all queued requests. We hold the lock
+	 * so no one else touches the queue. All requests in this batch share
+	 * the same param pointer. Stale alarms will fire and harmlessly find
+	 * nothing via ID-based lookup.
+	 */
+	if (ret != 0 && reply->nb_sent > 0) {
+		struct pending_request *r, *tmp;
+
+		RTE_TAILQ_FOREACH_SAFE(r, &pending_requests.requests, next, tmp) {
+			if (r->type == REQUEST_TYPE_ASYNC && r->async.param == param) {
+				TAILQ_REMOVE(&pending_requests.requests, r, next);
+				free(r->reply);
+				/* r->request == copy, freed below after the loop */
+				free(r);
+			}
+		}
+		/* requests on the queue were removed so keep things consistent */
+		reply->nb_sent = 0;
+	}
+
 	/* if we didn't send anything, put dummy request on the queue */
 	if (ret == 0 && reply->nb_sent == 0) {
 		TAILQ_INSERT_HEAD(&pending_requests.requests, dummy, next);
@@ -1236,6 +1258,11 @@ rte_mp_request_async(struct rte_mp_msg *req, const struct timespec *ts,
 	/* if dummy was unused, free it */
 	if (!dummy_used)
 		free(dummy);
+	/* if nothing was sent, nobody owns copy/param */
+	if (ret != 0) {
+		free(param);
+		free(copy);
+	}
 
 	return ret;
 closedir_fail:
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-03 12:55:48.292009639 +0100
+++ 0042-ipc-fix-memory-leaks-on-async-request-partial-failur.patch	2026-07-03 12:55:46.674574086 +0100
@@ -1 +1 @@
-From b901af4f0cacfc6eba6836299fdd416814dbe29e Mon Sep 17 00:00:00 2001
+From db041ce7076499d995bbb9245d1e14c9135606a2 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit b901af4f0cacfc6eba6836299fdd416814dbe29e ]
+
@@ -21 +22,0 @@
-Cc: stable at dpdk.org
@@ -29 +30 @@
-index b73e390e48..5c981f9da3 100644
+index 15ad3f6448..fb7220dd2c 100644
@@ -32,2 +33,2 @@
-@@ -1244,6 +1244,28 @@ rte_mp_request_async(struct rte_mp_msg *req, const struct timespec *ts,
- 		} else if (mp_request_async(path, copy, param, ts))
+@@ -1218,6 +1218,28 @@ rte_mp_request_async(struct rte_mp_msg *req, const struct timespec *ts,
+ 		if (mp_request_async(path, copy, param, ts))
@@ -61 +62 @@
-@@ -1262,6 +1284,11 @@ rte_mp_request_async(struct rte_mp_msg *req, const struct timespec *ts,
+@@ -1236,6 +1258,11 @@ rte_mp_request_async(struct rte_mp_msg *req, const struct timespec *ts,