| Message ID | 20241012110434.49265-1-wanghai38@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | cf57b5d7a2aad456719152ecd12007fe031628a3 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2,net] net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() | expand |
On 12.10.24 13:04, Wang Hai wrote: > The greth_start_xmit_gbit() returns NETDEV_TX_OK without freeing skb > in case of skb->len being too long, add dev_kfree_skb() to fix it. > > Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") > Signed-off-by: Wang Hai <wanghai38@huawei.com> > --- > v1->v2: Using dev_kfree_skb() in error handling. > drivers/net/ethernet/aeroflex/greth.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c > index 27af7746d645..adf6f67c5fcb 100644 > --- a/drivers/net/ethernet/aeroflex/greth.c > +++ b/drivers/net/ethernet/aeroflex/greth.c > @@ -484,7 +484,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev) > > if (unlikely(skb->len > MAX_FRAME_SIZE)) { > dev->stats.tx_errors++; > - goto out; > + goto len_error; > } > > /* Save skb pointer. */ > @@ -575,6 +575,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev) > map_error: > if (net_ratelimit()) > dev_warn(greth->dev, "Could not create TX DMA mapping\n"); > +len_error: > dev_kfree_skb(skb); > out: > return err; Reviewed-by: Gerhard Engleder <gerhard@engleder-embedded.com>
On Sat, 12 Oct 2024 19:04:34 +0800 Wang Hai wrote: > The greth_start_xmit_gbit() returns NETDEV_TX_OK without freeing skb > in case of skb->len being too long, add dev_kfree_skb() to fix it. > > Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") The fixes tag is incorrect. Please pay more careful attention. Just running git blame on the code you're touching is not enough. To save everyone time I will fix this when applying.
On Tue, 15 Oct 2024 10:01:27 -0700 Jakub Kicinski wrote: > On Sat, 12 Oct 2024 19:04:34 +0800 Wang Hai wrote: > > The greth_start_xmit_gbit() returns NETDEV_TX_OK without freeing skb > > in case of skb->len being too long, add dev_kfree_skb() to fix it. > > > > Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") > > The fixes tag is incorrect. Please pay more careful attention. I take that back, sorry. I was looking at greth_start_xmit vs greth_start_xmit_gbit
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Sat, 12 Oct 2024 19:04:34 +0800 you wrote: > The greth_start_xmit_gbit() returns NETDEV_TX_OK without freeing skb > in case of skb->len being too long, add dev_kfree_skb() to fix it. > > Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") > Signed-off-by: Wang Hai <wanghai38@huawei.com> > --- > v1->v2: Using dev_kfree_skb() in error handling. > drivers/net/ethernet/aeroflex/greth.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Here is the summary with links: - [v2,net] net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() https://git.kernel.org/netdev/net/c/cf57b5d7a2aa You are awesome, thank you!
diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c index 27af7746d645..adf6f67c5fcb 100644 --- a/drivers/net/ethernet/aeroflex/greth.c +++ b/drivers/net/ethernet/aeroflex/greth.c @@ -484,7 +484,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev) if (unlikely(skb->len > MAX_FRAME_SIZE)) { dev->stats.tx_errors++; - goto out; + goto len_error; } /* Save skb pointer. */ @@ -575,6 +575,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev) map_error: if (net_ratelimit()) dev_warn(greth->dev, "Could not create TX DMA mapping\n"); +len_error: dev_kfree_skb(skb); out: return err;
The greth_start_xmit_gbit() returns NETDEV_TX_OK without freeing skb in case of skb->len being too long, add dev_kfree_skb() to fix it. Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") Signed-off-by: Wang Hai <wanghai38@huawei.com> --- v1->v2: Using dev_kfree_skb() in error handling. drivers/net/ethernet/aeroflex/greth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)