patch 'net/memif: fix MAC address leak on probe failure' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/e61b2b0f5a7d59554d874cc3cc9a296c10dcca39

Thanks.

Luca Boccassi

---
>From e61b2b0f5a7d59554d874cc3cc9a296c10dcca39 Mon Sep 17 00:00:00 2001
From: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
Date: Fri, 16 Oct 2026 21:58:52 +0200
Subject: [PATCH] net/memif: fix MAC address leak on probe failure

[ upstream commit 44f8220ce647bae486de956b8b3c95acbd7b40c1 ]

rte_pmd_memif_probe() allocates the default MAC address up front and
only hands ownership to the device in memif_create() on success. Every
argument-parsing error jumps to the exit label, which freed the kvargs
but not the MAC address, leaking it. The allocation was also dereferenced
by rte_eth_random_addr() with no check that rte_zmalloc() succeeded, and
was done even in the secondary process which never uses it.

Allocate the MAC address only in the primary process after the secondary
path has returned, check it for NULL, and free it at the exit label on
any failure (on success memif_create() owns it via data->mac_addrs).
While here, return -ENOMEM instead of -1 on the secondary-process
process-private allocation failure, matching the primary path.

Fixes: 09c7e63a71f9 ("net/memif: introduce memory interface PMD")

Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
---
 drivers/net/memif/rte_eth_memif.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index 8acbddc5dc7..9382aefebfd 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -2235,12 +2235,9 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
 	gid_t owner_gid = -1;
 	uint32_t flags = 0;
 	const char *secret = NULL;
-	struct rte_ether_addr *ether_addr = rte_zmalloc("",
-		sizeof(struct rte_ether_addr), 0);
+	struct rte_ether_addr *ether_addr = NULL;
 	struct rte_eth_dev *eth_dev;
 
-	rte_eth_random_addr(ether_addr->addr_bytes);
-
 	MIF_LOG(INFO, "Initialize MEMIF: %s.", name);
 
 	if (rte_eal_process_type() == RTE_PROC_SECONDARY) {
@@ -2267,7 +2264,7 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
 		if (eth_dev->process_private == NULL) {
 			MIF_LOG(ERR,
 				"Failed to alloc memory for process private");
-			return -1;
+			return -ENOMEM;
 		}
 
 		rte_eth_dev_probing_finish(eth_dev);
@@ -2275,6 +2272,13 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
 		return 0;
 	}
 
+	ether_addr = rte_zmalloc("", sizeof(struct rte_ether_addr), 0);
+	if (ether_addr == NULL) {
+		MIF_LOG(ERR, "Failed to alloc MAC address");
+		return -ENOMEM;
+	}
+	rte_eth_random_addr(ether_addr->addr_bytes);
+
 	ret = rte_mp_action_register(MEMIF_MP_SEND_REGION, memif_mp_send_region);
 	/*
 	 * Primary process can continue probing, but secondary process won't
@@ -2349,6 +2353,12 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
 			   log2_ring_size, pkt_buffer_size, secret, ether_addr);
 
 exit:
+	/*
+	 * On success memif_create() takes ownership of ether_addr
+	 * (data->mac_addrs); free it on any failure or early exit.
+	 */
+	if (ret != 0)
+		rte_free(ether_addr);
 	rte_kvargs_free(kvlist);
 	return ret;
 }
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:47.975507791 +0000
+++ 0079-net-memif-fix-MAC-address-leak-on-probe-failure.patch	2026-11-05 16:42:45.013063535 +0000
@@ -1 +1 @@
-From 44f8220ce647bae486de956b8b3c95acbd7b40c1 Mon Sep 17 00:00:00 2001
+From e61b2b0f5a7d59554d874cc3cc9a296c10dcca39 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 44f8220ce647bae486de956b8b3c95acbd7b40c1 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -28 +29 @@
-index e753243440..70359554e6 100644
+index 8acbddc5dc7..9382aefebfd 100644
@@ -31 +32 @@
-@@ -2232,12 +2232,9 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
+@@ -2235,12 +2235,9 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
@@ -45 +46 @@
-@@ -2264,7 +2261,7 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
+@@ -2267,7 +2264,7 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
@@ -54 +55 @@
-@@ -2272,6 +2269,13 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
+@@ -2275,6 +2272,13 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
@@ -68 +69 @@
-@@ -2346,6 +2350,12 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)
+@@ -2349,6 +2353,12 @@ rte_pmd_memif_probe(struct rte_vdev_device *vdev)