patch 'net/iavf: fix leak of queue to traffic class mapping data' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/15/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/d36574c74fb50f3f3e9184a60bff711cfe80b782

Thanks.

Luca Boccassi

---
>From d36574c74fb50f3f3e9184a60bff711cfe80b782 Mon Sep 17 00:00:00 2001
From: Bruce Richardson <bruce.richardson at intel.com>
Date: Fri, 10 Jul 2026 11:33:59 +0100
Subject: [PATCH] net/iavf: fix leak of queue to traffic class mapping data

[ upstream commit 739500055acc65c6680c91a4644dbc73c2075cdd ]

On iavf TM hierarchy commit, the queue to traffic class mapping is
generated and stored in a pointer from the VF structure. However, that
data is never later freed. The data is also unnecessarily allocated from
hugepage memory.

Fix these issues by replacing rte_zmalloc with calloc, and then
appropriately freeing the memory at a) uninit of the device, b) at
failure of apply of the new settings and c) replacement of old data by
new.

Fixes: 3fd32df381f8 ("net/iavf: check Tx packet with correct UP and queue")

Signed-off-by: Bruce Richardson <bruce.richardson at intel.com>
Acked-by: Ciara Loftus <ciara.loftus at intel.com>
---
 drivers/net/iavf/iavf_ethdev.c |  2 ++
 drivers/net/iavf/iavf_tm.c     | 11 ++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/iavf/iavf_ethdev.c b/drivers/net/iavf/iavf_ethdev.c
index 38c0c7aa9c..57618e478c 100644
--- a/drivers/net/iavf/iavf_ethdev.c
+++ b/drivers/net/iavf/iavf_ethdev.c
@@ -2686,6 +2686,8 @@ iavf_uninit_vf(struct rte_eth_dev *dev)
 
 	rte_free(vf->qos_cap);
 	vf->qos_cap = NULL;
+	free(vf->qtc_map);
+	vf->qtc_map = NULL;
 
 	rte_free(vf->rss_lut);
 	vf->rss_lut = NULL;
diff --git a/drivers/net/iavf/iavf_tm.c b/drivers/net/iavf/iavf_tm.c
index 57632ebc71..86591e2b3c 100644
--- a/drivers/net/iavf/iavf_tm.c
+++ b/drivers/net/iavf/iavf_tm.c
@@ -97,6 +97,9 @@ iavf_tm_conf_uninit(struct rte_eth_dev *dev)
 			     shaper_profile, node);
 		rte_free(shaper_profile);
 	}
+
+	free(vf->qtc_map);
+	vf->qtc_map = NULL;
 }
 
 static inline struct iavf_tm_node *
@@ -801,7 +804,8 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 	struct virtchnl_queues_bw_cfg *q_bw = NULL;
 	struct iavf_tm_node_list *queue_list = &vf->tm_conf.queue_list;
 	struct iavf_tm_node *tm_node;
-	struct iavf_qtc_map *qtc_map;
+	struct iavf_qtc_map *qtc_map = NULL;
+	struct iavf_qtc_map *old_qtc_map = vf->qtc_map; /* to free memory if new map assigned */
 	uint16_t size, size_q;
 	int index = 0, node_committed = 0;
 	int i, ret_val = IAVF_SUCCESS;
@@ -883,8 +887,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 		goto fail_clear;
 
 	/* store the queue TC mapping info */
-	qtc_map = rte_zmalloc("qtc_map",
-		sizeof(struct iavf_qtc_map) * q_tc_mapping->num_tc, 0);
+	qtc_map = calloc(q_tc_mapping->num_tc, sizeof(struct iavf_qtc_map));
 	if (!qtc_map) {
 		ret_val = IAVF_ERR_NO_MEMORY;
 		goto fail_clear;
@@ -904,6 +907,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 		goto fail_clear;
 
 	vf->qtc_map = qtc_map;
+	free(old_qtc_map);
 	vf->tm_conf.committed = true;
 	free(q_bw);
 	free(q_tc_mapping);
@@ -918,5 +922,6 @@ fail_clear:
 err:
 	free(q_bw);
 	free(q_tc_mapping);
+	free(qtc_map);
 	return ret_val;
 }
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-13 18:17:06.172856158 +0100
+++ 0016-net-iavf-fix-leak-of-queue-to-traffic-class-mapping-.patch	2026-07-13 18:17:05.586283053 +0100
@@ -1 +1 @@
-From 739500055acc65c6680c91a4644dbc73c2075cdd Mon Sep 17 00:00:00 2001
+From d36574c74fb50f3f3e9184a60bff711cfe80b782 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 739500055acc65c6680c91a4644dbc73c2075cdd ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -22,2 +23,2 @@
- drivers/net/intel/iavf/iavf_ethdev.c |  2 ++
- drivers/net/intel/iavf/iavf_tm.c     | 11 ++++++++---
+ drivers/net/iavf/iavf_ethdev.c |  2 ++
+ drivers/net/iavf/iavf_tm.c     | 11 ++++++++---
@@ -26,5 +27,5 @@
-diff --git a/drivers/net/intel/iavf/iavf_ethdev.c b/drivers/net/intel/iavf/iavf_ethdev.c
-index 80e740ef29..1cd8c88384 100644
---- a/drivers/net/intel/iavf/iavf_ethdev.c
-+++ b/drivers/net/intel/iavf/iavf_ethdev.c
-@@ -2755,6 +2755,8 @@ iavf_uninit_vf(struct rte_eth_dev *dev)
+diff --git a/drivers/net/iavf/iavf_ethdev.c b/drivers/net/iavf/iavf_ethdev.c
+index 38c0c7aa9c..57618e478c 100644
+--- a/drivers/net/iavf/iavf_ethdev.c
++++ b/drivers/net/iavf/iavf_ethdev.c
+@@ -2686,6 +2686,8 @@ iavf_uninit_vf(struct rte_eth_dev *dev)
@@ -39,4 +40,4 @@
-diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
-index 5f888d654f..faa2d4b8a0 100644
---- a/drivers/net/intel/iavf/iavf_tm.c
-+++ b/drivers/net/intel/iavf/iavf_tm.c
+diff --git a/drivers/net/iavf/iavf_tm.c b/drivers/net/iavf/iavf_tm.c
+index 57632ebc71..86591e2b3c 100644
+--- a/drivers/net/iavf/iavf_tm.c
++++ b/drivers/net/iavf/iavf_tm.c
@@ -63 +64 @@
-@@ -889,8 +893,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+@@ -883,8 +887,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
@@ -73 +74 @@
-@@ -910,6 +913,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+@@ -904,6 +907,7 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
@@ -78,2 +79 @@
- 	if (adapter->stopped == 1)
- 		vf->tm_conf.committed = true;
+ 	vf->tm_conf.committed = true;
@@ -81 +81,2 @@
-@@ -925,5 +929,6 @@ fail_clear:
+ 	free(q_tc_mapping);
+@@ -918,5 +922,6 @@ fail_clear: