patch 'net/iavf: fix local memory leaks in TM hierarchy commit' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/15/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/7c8322c347361e02f214312e02323399b2c25304

Thanks.

Luca Boccassi

---
>From 7c8322c347361e02f214312e02323399b2c25304 Mon Sep 17 00:00:00 2001
From: Bruce Richardson <bruce.richardson at intel.com>
Date: Fri, 10 Jul 2026 11:33:58 +0100
Subject: [PATCH] net/iavf: fix local memory leaks in TM hierarchy commit

[ upstream commit 0712e098a828721cd64f72e378762bff47d819ec ]

The iavf_hierachy_commit function uses a number of temporary variables,
which, though small, are still leaked at function end. Clean this up by
freeing them before the function returns. Since these are not variables
that need to be in hugepage memory, also switch from using rte_zmalloc
to calloc.

Fixes: 44d0a720a538 ("net/iavf: query QoS capabilities and set queue TC mapping")
Fixes: 5779a8894d15 ("net/iavf: support queue rate limit configuration")

Signed-off-by: Bruce Richardson <bruce.richardson at intel.com>
Acked-by: Ciara Loftus <ciara.loftus at intel.com>
---
 drivers/net/iavf/iavf_tm.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/net/iavf/iavf_tm.c b/drivers/net/iavf/iavf_tm.c
index efdbb45b62..57632ebc71 100644
--- a/drivers/net/iavf/iavf_tm.c
+++ b/drivers/net/iavf/iavf_tm.c
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: BSD-3-Clause
  * Copyright(c) 2010-2017 Intel Corporation
  */
+#include <stdlib.h>
+
 #include <rte_tm_driver.h>
 
 #include "iavf.h"
@@ -795,8 +797,8 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 	struct iavf_info *vf = IAVF_DEV_PRIVATE_TO_VF(dev->data->dev_private);
 	struct iavf_adapter *adapter =
 		IAVF_DEV_PRIVATE_TO_ADAPTER(dev->data->dev_private);
-	struct virtchnl_queue_tc_mapping *q_tc_mapping;
-	struct virtchnl_queues_bw_cfg *q_bw;
+	struct virtchnl_queue_tc_mapping *q_tc_mapping = NULL;
+	struct virtchnl_queues_bw_cfg *q_bw = NULL;
 	struct iavf_tm_node_list *queue_list = &vf->tm_conf.queue_list;
 	struct iavf_tm_node *tm_node;
 	struct iavf_qtc_map *qtc_map;
@@ -826,7 +828,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 
 	size = sizeof(*q_tc_mapping) + sizeof(q_tc_mapping->tc[0]) *
 		(vf->qos_cap->num_elem - 1);
-	q_tc_mapping = rte_zmalloc("q_tc", size, 0);
+	q_tc_mapping = calloc(1, size);
 	if (!q_tc_mapping) {
 		ret_val = IAVF_ERR_NO_MEMORY;
 		goto fail_clear;
@@ -834,7 +836,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 
 	size_q = sizeof(*q_bw) + sizeof(q_bw->cfg[0]) *
 		(vf->num_queue_pairs - 1);
-	q_bw = rte_zmalloc("q_bw", size_q, 0);
+	q_bw = calloc(1, size_q);
 	if (!q_bw) {
 		ret_val = IAVF_ERR_NO_MEMORY;
 		goto fail_clear;
@@ -883,8 +885,10 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 	/* store the queue TC mapping info */
 	qtc_map = rte_zmalloc("qtc_map",
 		sizeof(struct iavf_qtc_map) * q_tc_mapping->num_tc, 0);
-	if (!qtc_map)
-		return IAVF_ERR_NO_MEMORY;
+	if (!qtc_map) {
+		ret_val = IAVF_ERR_NO_MEMORY;
+		goto fail_clear;
+	}
 
 	for (i = 0; i < q_tc_mapping->num_tc; i++) {
 		q_tc_mapping->tc[i].req.start_queue_id = index;
@@ -901,6 +905,8 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 
 	vf->qtc_map = qtc_map;
 	vf->tm_conf.committed = true;
+	free(q_bw);
+	free(q_tc_mapping);
 	return ret_val;
 
 fail_clear:
@@ -910,5 +916,7 @@ fail_clear:
 		iavf_tm_conf_init(dev);
 	}
 err:
+	free(q_bw);
+	free(q_tc_mapping);
 	return ret_val;
 }
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-13 18:17:06.137055486 +0100
+++ 0015-net-iavf-fix-local-memory-leaks-in-TM-hierarchy-comm.patch	2026-07-13 18:17:05.582282980 +0100
@@ -1 +1 @@
-From 0712e098a828721cd64f72e378762bff47d819ec Mon Sep 17 00:00:00 2001
+From 7c8322c347361e02f214312e02323399b2c25304 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 0712e098a828721cd64f72e378762bff47d819ec ]
+
@@ -14 +15,0 @@
-Cc: stable at dpdk.org
@@ -19 +20 @@
- drivers/net/intel/iavf/iavf_tm.c | 20 ++++++++++++++------
+ drivers/net/iavf/iavf_tm.c | 20 ++++++++++++++------
@@ -22,4 +23,4 @@
-diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
-index e3492ec491..5f888d654f 100644
---- a/drivers/net/intel/iavf/iavf_tm.c
-+++ b/drivers/net/intel/iavf/iavf_tm.c
+diff --git a/drivers/net/iavf/iavf_tm.c b/drivers/net/iavf/iavf_tm.c
+index efdbb45b62..57632ebc71 100644
+--- a/drivers/net/iavf/iavf_tm.c
++++ b/drivers/net/iavf/iavf_tm.c
@@ -46 +47 @@
-@@ -832,7 +834,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+@@ -826,7 +828,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
@@ -55 +56 @@
-@@ -840,7 +842,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+@@ -834,7 +836,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
@@ -64 +65 @@
-@@ -889,8 +891,10 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+@@ -883,8 +885,10 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
@@ -77 +78,2 @@
-@@ -908,6 +912,8 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+@@ -901,6 +905,8 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+ 
@@ -79,2 +81 @@
- 	if (adapter->stopped == 1)
- 		vf->tm_conf.committed = true;
+ 	vf->tm_conf.committed = true;
@@ -86 +87 @@
-@@ -917,5 +923,7 @@ fail_clear:
+@@ -910,5 +916,7 @@ fail_clear: