From 24d0af194bcca043bd82f8a0842a051cdde266ee Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 21 Jul 2026 16:39:50 +0000 Subject: [PATCH] geneve: fix geneve_config leak on register_netdevice() failure When geneve_configure() allocates a new geneve_config structure via geneve_config_alloc() and assigns it to geneve->cfg before calling register_netdevice(), if register_netdevice() fails early (for example, in dev_get_valid_name() due to an invalid or duplicate interface name), register_netdevice() exits without calling dev->priv_destructor. The caller (e.g. rtnl_newlink()) subsequently calls free_netdev(), which frees the net_device structure directly via kvfree() because reg_state is NETREG_UNINITIALIZED, bypassing dev->priv_destructor (geneve_free_dev()). As a result, the newly allocated geneve_config and its per-CPU dst_cache are leaked. Fix this by invoking geneve_free_dev(dev) directly on the error path of register_netdevice(). Since geneve_free_dev() sets geneve->cfg to NULL, this call is fully idempotent and safe even if register_netdevice() failed on a later error path that already ran dev->priv_destructor. Fixes: 0ba269933f73 ("geneve: convert config to RCU-protected pointer") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260721163950.1483019-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- drivers/net/geneve.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index 359d6da7348c..9a9e357fca1a 100644 --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -2045,8 +2045,10 @@ static int geneve_configure(struct net *net, struct net_device *dev, } err = register_netdevice(dev); - if (err) + if (err) { + geneve_free_dev(dev); return err; + } list_add(&geneve->next, &gn->geneve_list); return 0;