Commit fe868b49 authored Jan 22, 2026 by Zilin Guan Committed by Tony Nguyen Mar 03, 2026

ice: Fix memory leak in ice_set_ringparam()



In ice_set_ringparam, tx_rings and xdp_rings are allocated before
rx_rings. If the allocation of rx_rings fails, the code jumps to
the done label leaking both tx_rings and xdp_rings. Furthermore, if
the setup of an individual Rx ring fails during the loop, the code jumps
to the free_tx label which releases tx_rings but leaks xdp_rings.

Fix this by introducing a free_xdp label and updating the error paths to
ensure both xdp_rings and tx_rings are properly freed if rx_rings
allocation or setup fails.

Compile tested only. Issue found using a prototype static analysis tool
and code review.

Fixes: fcea6f3d ("ice: Add stats and ethtool support")
Fixes: efc2214b ("ice: Add support for XDP")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>

parent fb4903b3

drivers/net/ethernet/intel/ice/ice_ethtool.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -3332,7 +3332,7 @@ ice_set_ringparam(struct net_device netdev, struct ethtool_ringparam ring,
		rx_rings = kzalloc_objs(*rx_rings, vsi->num_rxq);
		if (!rx_rings) {
		err = -ENOMEM;
		goto done;
		goto free_xdp;
		}

		ice_for_each_rxq(vsi, i) {
		@@ -3359,7 +3359,7 @@ ice_set_ringparam(struct net_device netdev, struct ethtool_ringparam ring,
		}
		kfree(rx_rings);
		err = -ENOMEM;
		goto free_tx;
		goto free_xdp;
		}
		}

		@@ -3411,6 +3411,13 @@ ice_set_ringparam(struct net_device netdev, struct ethtool_ringparam ring,
		}
		goto done;

		free_xdp:
		if (xdp_rings) {
		ice_for_each_xdp_txq(vsi, i)
		ice_free_tx_ring(&xdp_rings[i]);
		kfree(xdp_rings);
		}

		free_tx:
		/* error cleanup if the Rx allocations failed after getting Tx */
		if (tx_rings) {