From: Jakub Kicinski <kuba@kernel.org>
Date: Fri, 22 May 2026 23:06:45 +0000 (-0700)
Subject: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
X-Git-Tag: v7.1-rc6~27^2~17^2~2
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=266297692f97008ca48bc311775c087c59bd7fe3;p=thirdparty%2Fkernel%2Fstable.git

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure

rss_prepare_get() allocates the indirection table and hash key buffer
via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them.
If get_rxfh() fails, the function returns an error without freeing
the allocation.

Fixes: 4f038a6a02d2 ("net: ethtool: Don't call .cleanup_data when prepare_data fails")
Link: https://patch.msgid.link/20260522230647.1705600-5-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/net/ethtool/rss.c b/net/ethtool/rss.c
index 458a4a7907e4..9fb675d29232 100644
--- a/net/ethtool/rss.c
+++ b/net/ethtool/rss.c
@@ -170,8 +170,10 @@ rss_prepare_get(const struct rss_req_info *request, struct net_device *dev,
 	rxfh.key = data->hkey;
 
 	ret = ops->get_rxfh(dev, &rxfh);
-	if (ret)
+	if (ret) {
+		rss_get_data_free(data);
 		goto out_unlock;
+	}
 
 	data->hfunc = rxfh.hfunc;
 	data->input_xfrm = rxfh.input_xfrm;