patch 'net/iavf: fix leak of queue to traffic class mapping data' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/04/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/c9a357eb5be7dda98bfb50dc40dec9437dd27e0d

Thanks.

Kevin

---
>From c9a357eb5be7dda98bfb50dc40dec9437dd27e0d Mon Sep 17 00:00:00 2001
From: Bruce Richardson <bruce.richardson at intel.com>
Date: Fri, 10 Jul 2026 11:33:59 +0100
Subject: [PATCH] net/iavf: fix leak of queue to traffic class mapping data

[ upstream commit 739500055acc65c6680c91a4644dbc73c2075cdd ]

On iavf TM hierarchy commit, the queue to traffic class mapping is
generated and stored in a pointer from the VF structure. However, that
data is never later freed. The data is also unnecessarily allocated from
hugepage memory.

Fix these issues by replacing rte_zmalloc with calloc, and then
appropriately freeing the memory at a) uninit of the device, b) at
failure of apply of the new settings and c) replacement of old data by
new.

Fixes: 3fd32df381f8 ("net/iavf: check Tx packet with correct UP and queue")

Signed-off-by: Bruce Richardson <bruce.richardson at intel.com>
Acked-by: Ciara Loftus <ciara.loftus at intel.com>
---
 drivers/net/intel/iavf/iavf_ethdev.c |  2 ++
 drivers/net/intel/iavf/iavf_tm.c     | 11 ++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/intel/iavf/iavf_ethdev.c b/drivers/net/intel/iavf/iavf_ethdev.c
index 0be5d8241b..b5339c6ecb 100644
--- a/drivers/net/intel/iavf/iavf_ethdev.c
+++ b/drivers/net/intel/iavf/iavf_ethdev.c
@@ -2704,4 +2704,6 @@ iavf_uninit_vf(struct rte_eth_dev *dev)
 	rte_free(vf->qos_cap);
 	vf->qos_cap = NULL;
+	free(vf->qtc_map);
+	vf->qtc_map = NULL;
 
 	rte_free(vf->rss_lut);
diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
index 57632ebc71..86591e2b3c 100644
--- a/drivers/net/intel/iavf/iavf_tm.c
+++ b/drivers/net/intel/iavf/iavf_tm.c
@@ -98,4 +98,7 @@ iavf_tm_conf_uninit(struct rte_eth_dev *dev)
 		rte_free(shaper_profile);
 	}
+
+	free(vf->qtc_map);
+	vf->qtc_map = NULL;
 }
 
@@ -802,5 +805,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 	struct iavf_tm_node_list *queue_list = &vf->tm_conf.queue_list;
 	struct iavf_tm_node *tm_node;
-	struct iavf_qtc_map *qtc_map;
+	struct iavf_qtc_map *qtc_map = NULL;
+	struct iavf_qtc_map *old_qtc_map = vf->qtc_map; /* to free memory if new map assigned */
 	uint16_t size, size_q;
 	int index = 0, node_committed = 0;
@@ -884,6 +888,5 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 
 	/* store the queue TC mapping info */
-	qtc_map = rte_zmalloc("qtc_map",
-		sizeof(struct iavf_qtc_map) * q_tc_mapping->num_tc, 0);
+	qtc_map = calloc(q_tc_mapping->num_tc, sizeof(struct iavf_qtc_map));
 	if (!qtc_map) {
 		ret_val = IAVF_ERR_NO_MEMORY;
@@ -905,4 +908,5 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
 
 	vf->qtc_map = qtc_map;
+	free(old_qtc_map);
 	vf->tm_conf.committed = true;
 	free(q_bw);
@@ -919,4 +923,5 @@ err:
 	free(q_bw);
 	free(q_tc_mapping);
+	free(qtc_map);
 	return ret_val;
 }
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-30 10:16:03.070193455 +0100
+++ 0055-net-iavf-fix-leak-of-queue-to-traffic-class-mapping-.patch	2026-07-30 10:16:01.488228767 +0100
@@ -1 +1 @@
-From 739500055acc65c6680c91a4644dbc73c2075cdd Mon Sep 17 00:00:00 2001
+From c9a357eb5be7dda98bfb50dc40dec9437dd27e0d Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 739500055acc65c6680c91a4644dbc73c2075cdd ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -27 +28 @@
-index 80e740ef29..1cd8c88384 100644
+index 0be5d8241b..b5339c6ecb 100644
@@ -30 +31 @@
-@@ -2756,4 +2756,6 @@ iavf_uninit_vf(struct rte_eth_dev *dev)
+@@ -2704,4 +2704,6 @@ iavf_uninit_vf(struct rte_eth_dev *dev)
@@ -38 +39 @@
-index 5f888d654f..faa2d4b8a0 100644
+index 57632ebc71..86591e2b3c 100644
@@ -57 +58 @@
-@@ -890,6 +894,5 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+@@ -884,6 +888,5 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
@@ -65 +66 @@
-@@ -911,4 +914,5 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
+@@ -905,4 +908,5 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
@@ -69,3 +70,3 @@
- 	if (adapter->stopped == 1)
- 		vf->tm_conf.committed = true;
-@@ -926,4 +930,5 @@ err:
+ 	vf->tm_conf.committed = true;
+ 	free(q_bw);
+@@ -919,4 +923,5 @@ err: