patch 'net/iavf: fix memory leaks in RSS flow engine' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/f452389c7b12f913b67201fbf3305b36fe556b24

Thanks.

Luca Boccassi

---
>From f452389c7b12f913b67201fbf3305b36fe556b24 Mon Sep 17 00:00:00 2001
From: Anurag Mandal <anurag.mandal at intel.com>
Date: Sat, 10 Oct 2026 12:12:55 +0000
Subject: [PATCH] net/iavf: fix memory leaks in RSS flow engine

[ upstream commit 31c4f1e6308d82f911ba2536632c56ad2a94c233 ]

This patch addresses several memory leaks and incorrect error reporting
that exist in the iavf RSS (hash) flow engine:

- iavf_hash_parse_raw_pattern() returns without freeing "pkt_buf" when
  the "msk_buf" allocation fails, leaking the first buffer on every
  failed raw pattern parse.

- iavf_hash_create() only frees the parsed "meta" on success.  Both
  error paths return early and leak the struct iavf_rss_meta allocated
  by iavf_hash_parse_pattern_action(), which no other caller frees.
  Free in both error paths.

- iavf_hash_destroy() never releases flow->rule.  The virtchnl_rss_cfg
  allocated by iavf_hash_create() is only released by the engine's free
  callback, iavf_hash_free(), which is invoked from iavf_flow_uninit()
  but not from iavf_flow_destroy().  So every flow destroy or flush of
  an RSS rule leaks it.  The early return taken while the VF is
  resetting leaks it too.  Free the config and clear flow->rule properly
  in all paths.

- Out of memory conditions are reported to the application as EINVAL
  while -ENOMEM is returned.  Report ENOMEM instead.

Fixes: bc0e85586eaf ("net/iavf: support VF RSS flow rule with raw pattern")
Fixes: 7be10c3004be ("net/iavf: add RSS configuration for VF")
Fixes: c02ea7410e51 ("net/iavf: fix flow flush after PF reset")

Signed-off-by: Anurag Mandal <anurag.mandal at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/iavf/iavf_hash.c | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/drivers/net/iavf/iavf_hash.c b/drivers/net/iavf/iavf_hash.c
index 217f0500aba..0e85cd26a50 100644
--- a/drivers/net/iavf/iavf_hash.c
+++ b/drivers/net/iavf/iavf_hash.c
@@ -907,8 +907,10 @@ iavf_hash_parse_raw_pattern(const struct rte_flow_item *item,
 		return -ENOMEM;
 
 	msk_buf = rte_zmalloc(NULL, pkt_len, 0);
-	if (!msk_buf)
+	if (!msk_buf) {
+		rte_free(pkt_buf);
 		return -ENOMEM;
+	}
 
 	/* convert string to int array */
 	for (i = 0, j = 0; i < spec_len; i += 2, j++) {
@@ -1524,7 +1526,7 @@ iavf_hash_parse_pattern_action(__rte_unused struct iavf_adapter *ad,
 
 	rss_meta_ptr = rte_zmalloc(NULL, sizeof(*rss_meta_ptr), 0);
 	if (!rss_meta_ptr) {
-		rte_flow_error_set(error, EINVAL,
+		rte_flow_error_set(error, ENOMEM,
 				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
 				   "No memory for rss_meta_ptr");
 		return -ENOMEM;
@@ -1580,9 +1582,10 @@ iavf_hash_create(__rte_unused struct iavf_adapter *ad,
 	rss_cfg = rte_zmalloc("iavf rss rule",
 			      sizeof(struct virtchnl_rss_cfg), 0);
 	if (!rss_cfg) {
-		rte_flow_error_set(error, EINVAL,
+		rte_flow_error_set(error, ENOMEM,
 				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
 				   "No memory for rss rule");
+		rte_free(meta);
 		return -ENOMEM;
 	}
 
@@ -1598,6 +1601,7 @@ iavf_hash_create(__rte_unused struct iavf_adapter *ad,
 				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
 				   "Failed to add rss rule.");
 		rte_free(rss_cfg);
+		rte_free(meta);
 		return -rte_errno;
 	}
 
@@ -1615,19 +1619,22 @@ iavf_hash_destroy(__rte_unused struct iavf_adapter *ad,
 	struct virtchnl_rss_cfg *rss_cfg;
 	int ret = 0;
 
-	if (vf->vf_reset)
-		return 0;
-
 	rss_cfg = (struct virtchnl_rss_cfg *)flow->rule;
 
-	ret = iavf_add_del_rss_cfg(ad, rss_cfg, false);
-	if (ret) {
-		PMD_DRV_LOG(ERR, "fail to del RSS configure");
-		rte_flow_error_set(error, -ret,
-				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
-				   "Failed to delete rss rule.");
-		return -rte_errno;
+	if (!vf->vf_reset) {
+		ret = iavf_add_del_rss_cfg(ad, rss_cfg, false);
+		if (ret) {
+			PMD_DRV_LOG(ERR, "fail to del RSS configure");
+			rte_flow_error_set(error, -ret,
+					   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
+					   "Failed to delete rss rule.");
+			return -rte_errno;
+		}
 	}
+
+	flow->rule = NULL;
+	rte_free(rss_cfg);
+
 	return ret;
 }
 
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:46.628159903 +0000
+++ 0042-net-iavf-fix-memory-leaks-in-RSS-flow-engine.patch	2026-11-05 16:42:44.949061623 +0000
@@ -1 +1 @@
-From 31c4f1e6308d82f911ba2536632c56ad2a94c233 Mon Sep 17 00:00:00 2001
+From f452389c7b12f913b67201fbf3305b36fe556b24 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 31c4f1e6308d82f911ba2536632c56ad2a94c233 ]
+
@@ -32 +33,0 @@
-Cc: stable at dpdk.org
@@ -37 +38 @@
- drivers/net/intel/iavf/iavf_hash.c | 33 ++++++++++++++++++------------
+ drivers/net/iavf/iavf_hash.c | 33 ++++++++++++++++++++-------------
@@ -40,5 +41,5 @@
-diff --git a/drivers/net/intel/iavf/iavf_hash.c b/drivers/net/intel/iavf/iavf_hash.c
-index 9515094402..00b616f34b 100644
---- a/drivers/net/intel/iavf/iavf_hash.c
-+++ b/drivers/net/intel/iavf/iavf_hash.c
-@@ -918,8 +918,10 @@ iavf_hash_parse_raw_pattern(const struct rte_flow_item *item,
+diff --git a/drivers/net/iavf/iavf_hash.c b/drivers/net/iavf/iavf_hash.c
+index 217f0500aba..0e85cd26a50 100644
+--- a/drivers/net/iavf/iavf_hash.c
++++ b/drivers/net/iavf/iavf_hash.c
+@@ -907,8 +907,10 @@ iavf_hash_parse_raw_pattern(const struct rte_flow_item *item,
@@ -56 +57 @@
-@@ -1538,7 +1540,7 @@ iavf_hash_parse_pattern_action(struct iavf_adapter *ad,
+@@ -1524,7 +1526,7 @@ iavf_hash_parse_pattern_action(__rte_unused struct iavf_adapter *ad,
@@ -65 +66 @@
-@@ -1594,9 +1596,10 @@ iavf_hash_create(__rte_unused struct iavf_adapter *ad,
+@@ -1580,9 +1582,10 @@ iavf_hash_create(__rte_unused struct iavf_adapter *ad,
@@ -77 +78 @@
-@@ -1612,6 +1615,7 @@ iavf_hash_create(__rte_unused struct iavf_adapter *ad,
+@@ -1598,6 +1601,7 @@ iavf_hash_create(__rte_unused struct iavf_adapter *ad,
@@ -85 +86 @@
-@@ -1629,19 +1633,22 @@ iavf_hash_destroy(__rte_unused struct iavf_adapter *ad,
+@@ -1615,19 +1619,22 @@ iavf_hash_destroy(__rte_unused struct iavf_adapter *ad,