On Sun, 25 Oct 2026 01:46:33 +0000
Chen Zhao <[email protected]> wrote:
> rte_realloc() failure overwrites event_buf and leaks the old allocation.
> Save the old pointer and free it on failure before resetting event_sz.
>
> Fixes: 1f2766b7ee02 ("net/netvsc: resize event buffer as needed")
> Cc: [email protected]
> Cc: [email protected]
> Signed-off-by: Chen Zhao <[email protected]>
> ---
AI review says "good but it could be better"
On Sun, 25 Oct 2026 01:46:33 +0000
Chen Zhao <[email protected]> wrote:
> rte_realloc() failure overwrites event_buf and leaks the old allocation.
> Save the old pointer and free it on failure before resetting event_sz.
The leak is real, but freeing the old buffer is the wrong recovery.
The old buffer is still valid and usable for smaller events; there is
no reason to throw it away. Also event_sz is updated before the
allocation succeeds.
Use a temporary and only commit on success:
if (unlikely(ret == -ENOBUFS)) {
/* event buffer not large enough to read ring */
uint32_t new_sz = len + len / 4;
void *new_buf;
PMD_DRV_LOG(DEBUG,
"event buffer expansion (need %u)", len);
new_buf = rte_realloc(rxq->event_buf, new_sz,
RTE_CACHE_LINE_SIZE);
if (new_buf == NULL)
break; /* out of memory, no more events now */
rxq->event_buf = new_buf;
rxq->event_sz = new_sz;
goto retry;
}
Drop the Cc to [email protected], that address is dead.
