hns3_alloc_ring_memory() creates the page pool and then fills the RX ring with buffers from it. If filling the ring fails, the error path only frees the descriptors and the descriptor callbacks, so the page pool created a moment earlier is leaked. The page pool is normally destroyed by hns3_fini_ring(), but hns3_init_all_ring() only cleans up the rings that were set up before the failing one, so the pool of the failing ring is never released. Destroy the page pool on the buffer allocation failure path too. Fixes: 93188e9642c3 ("net: hns3: support skb's frag page recycling based on page pool") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 47788be64be6..fe339ddc6379 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -5073,6 +5073,10 @@ static int hns3_alloc_ring_memory(struct hns3_enet_ring *ring) out_with_desc: hns3_free_desc(ring); + if (ring->page_pool) { + page_pool_destroy(ring->page_pool); + ring->page_pool = NULL; + } out_with_desc_cb: devm_kfree(ring_to_dev(ring), ring->desc_cb); ring->desc_cb = NULL; -- 2.34.1