[PATCH v2 04/15] raw/ntb: fix memory leaks

Raghavendra Ningoji raghavendra.ningoji at amd.com
Fri Nov 6 06:50:34 CET 2026


The memory window size array allocated by the vendor init at probe
time was never freed.
The peer memory window base array allocated at each device start was
only freed if the start failed, so it leaked on every stop/start cycle.

As the number of memory windows is fixed for all supported devices,
embed the memory window size array in the device private data instead
of allocating it: it lives as long as the device and remains valid for
the info get after close.
Free the peer memory window base array when stopping the device.

Fixes: c39d1e082a4b ("raw/ntb: setup queues")
Fixes: d6dc5a7f8b06 ("raw/ntb: support AMD NTB")
Cc: stable at dpdk.org

Signed-off-by: Raghavendra Ningoji <raghavendra.ningoji at amd.com>
---
 drivers/raw/ntb/ntb.c          | 6 ++++++
 drivers/raw/ntb/ntb.h          | 5 ++++-
 drivers/raw/ntb/ntb_hw_amd.c   | 6 +-----
 drivers/raw/ntb/ntb_hw_intel.c | 8 +-------
 4 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/drivers/raw/ntb/ntb.c b/drivers/raw/ntb/ntb.c
index e42af0b9c5..5985604cce 100644
--- a/drivers/raw/ntb/ntb.c
+++ b/drivers/raw/ntb/ntb.c
@@ -820,6 +820,8 @@ ntb_dev_start(struct rte_rawdev *dev)
 
 err_up:
 	rte_free(hw->peer_mw_base);
+	hw->peer_mw_base = NULL;
+	hw->peer_used_mws = 0;
 err_q_init:
 	for (i = 0; i < hw->queue_pairs; i++) {
 		ntb_rxq_release_mbufs(hw->rx_queues[i]);
@@ -872,6 +874,10 @@ ntb_dev_stop(struct rte_rawdev *dev)
 		ntb_txq_release_mbufs(hw->tx_queues[i]);
 	}
 
+	rte_free(hw->peer_mw_base);
+	hw->peer_mw_base = NULL;
+	hw->peer_used_mws = 0;
+
 	dev->started = 0;
 }
 
diff --git a/drivers/raw/ntb/ntb.h b/drivers/raw/ntb/ntb.h
index 0181bec5c9..31bf0f3260 100644
--- a/drivers/raw/ntb/ntb.h
+++ b/drivers/raw/ntb/ntb.h
@@ -17,6 +17,9 @@ extern int ntb_logtype;
 #define NTB_SPAD_USER               "spad_user_"
 #define NTB_SPAD_USER_LEN           (sizeof(NTB_SPAD_USER) - 1)
 #define NTB_SPAD_USER_MAX_NUM       4
+
+/* Maximum number of memory windows of supported devices. */
+#define NTB_MAX_MW                  2
 #define NTB_ATTR_NAME_LEN           30
 
 #define NTB_DFLT_TX_FREE_THRESH     256
@@ -220,7 +223,7 @@ struct ntb_hw {
 	char *hw_addr;
 
 	uint8_t peer_dev_up;
-	uint64_t *mw_size;
+	uint64_t mw_size[NTB_MAX_MW];
 	/* remote mem base addr */
 	uint64_t *peer_mw_base;
 
diff --git a/drivers/raw/ntb/ntb_hw_amd.c b/drivers/raw/ntb/ntb_hw_amd.c
index 64075501c2..9b274bc6b9 100644
--- a/drivers/raw/ntb/ntb_hw_amd.c
+++ b/drivers/raw/ntb/ntb_hw_amd.c
@@ -53,6 +53,7 @@ amd_ntb_dev_init(const struct rte_rawdev *dev)
 	NTB_LOG(INFO, "Device topology: %s (sideinfo 0x%" PRIx32 ")",
 		ntb->topo == NTB_TOPO_SEC ? "secondary" : "primary", sideinfo);
 
+	RTE_BUILD_BUG_ON(AMD_MW_COUNT > NTB_MAX_MW);
 	ntb->mw_cnt = AMD_MW_COUNT;
 	ntb->db_cnt = AMD_DB_COUNT;
 	/* The 16-register scratchpad bank is split into two halves, so only
@@ -60,11 +61,6 @@ amd_ntb_dev_init(const struct rte_rawdev *dev)
 	 */
 	ntb->spad_cnt = AMD_SPAD_PER_SIDE;
 
-	ntb->mw_size = rte_zmalloc("ntb_mw_size", ntb->mw_cnt * sizeof(uint64_t), 0);
-	if (ntb->mw_size == NULL) {
-		NTB_LOG(ERR, "Cannot allocate memory for mw size.");
-		return -ENOMEM;
-	}
 	for (i = 0; i < ntb->mw_cnt; i++) {
 		bar = amd_ntb_bar[i];
 		ntb->mw_size[i] = ntb->pci_dev->mem_resource[bar].len;
diff --git a/drivers/raw/ntb/ntb_hw_intel.c b/drivers/raw/ntb/ntb_hw_intel.c
index 47d5d39339..ad8e330199 100644
--- a/drivers/raw/ntb/ntb_hw_intel.c
+++ b/drivers/raw/ntb/ntb_hw_intel.c
@@ -194,17 +194,11 @@ intel_ntb_dev_init(const struct rte_rawdev *dev)
 	if (ret)
 		return ret;
 
+	RTE_BUILD_BUG_ON(XEON_MW_COUNT > NTB_MAX_MW);
 	hw->mw_cnt = XEON_MW_COUNT;
 	hw->db_cnt = XEON_DB_COUNT;
 	hw->spad_cnt = XEON_SPAD_COUNT;
 
-	hw->mw_size = rte_zmalloc("ntb_mw_size",
-				  hw->mw_cnt * sizeof(uint64_t), 0);
-	if (hw->mw_size == NULL) {
-		NTB_LOG(ERR, "Cannot allocate memory for mw size.");
-		return -ENOMEM;
-	}
-
 	for (i = 0; i < hw->mw_cnt; i++) {
 		bar = intel_ntb_bar[i];
 		hw->mw_size[i] = hw->pci_dev->mem_resource[bar].len;
-- 
2.34.1



More information about the stable mailing list