| Message ID | 1668675039-21138-1-git-send-email-zhangchangzhong@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 62a7311fb96c61d281da9852dbee4712fc8c3277 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net/qla3xxx: fix potential memleak in ql3xxx_send() | expand |
On Thu, Nov 17, 2022 at 04:50:38PM +0800, Zhang Changzhong wrote: > The ql3xxx_send() returns NETDEV_TX_OK without freeing skb in error > handling case, add dev_kfree_skb_any() to fix it. Can you please remind me why should it release? There are no paths in ql3xxx_send() that release skb. Thanks > > Fixes: bd36b0ac5d06 ("qla3xxx: Add support for Qlogic 4032 chip.") > Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> > --- > drivers/net/ethernet/qlogic/qla3xxx.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c > index 76072f8..0d57ffc 100644 > --- a/drivers/net/ethernet/qlogic/qla3xxx.c > +++ b/drivers/net/ethernet/qlogic/qla3xxx.c > @@ -2471,6 +2471,7 @@ static netdev_tx_t ql3xxx_send(struct sk_buff *skb, > skb_shinfo(skb)->nr_frags); > if (tx_cb->seg_count == -1) { > netdev_err(ndev, "%s: invalid segment count!\n", __func__); > + dev_kfree_skb_any(skb); > return NETDEV_TX_OK; > } > > -- > 2.9.5 >
On 2022/11/17 19:38, Leon Romanovsky wrote: > On Thu, Nov 17, 2022 at 04:50:38PM +0800, Zhang Changzhong wrote: >> The ql3xxx_send() returns NETDEV_TX_OK without freeing skb in error >> handling case, add dev_kfree_skb_any() to fix it. > > Can you please remind me why should it release? > There are no paths in ql3xxx_send() that release skb. > > Thanks > If ql_send_map() returns NETDEV_TX_OK, the packet is sent, and ql_process_mac_tx_intr() releases tx_cb->skb. However, the skb cannot be released in this error path. Thanks, Changzhong >> >> Fixes: bd36b0ac5d06 ("qla3xxx: Add support for Qlogic 4032 chip.") >> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> >> --- >> drivers/net/ethernet/qlogic/qla3xxx.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c >> index 76072f8..0d57ffc 100644 >> --- a/drivers/net/ethernet/qlogic/qla3xxx.c >> +++ b/drivers/net/ethernet/qlogic/qla3xxx.c >> @@ -2471,6 +2471,7 @@ static netdev_tx_t ql3xxx_send(struct sk_buff *skb, >> skb_shinfo(skb)->nr_frags); >> if (tx_cb->seg_count == -1) { >> netdev_err(ndev, "%s: invalid segment count!\n", __func__); >> + dev_kfree_skb_any(skb); >> return NETDEV_TX_OK; >> } >> >> -- >> 2.9.5 >> > . >
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Thu, 17 Nov 2022 16:50:38 +0800 you wrote: > The ql3xxx_send() returns NETDEV_TX_OK without freeing skb in error > handling case, add dev_kfree_skb_any() to fix it. > > Fixes: bd36b0ac5d06 ("qla3xxx: Add support for Qlogic 4032 chip.") > Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> > --- > drivers/net/ethernet/qlogic/qla3xxx.c | 1 + > 1 file changed, 1 insertion(+) Here is the summary with links: - [net] net/qla3xxx: fix potential memleak in ql3xxx_send() https://git.kernel.org/netdev/net/c/62a7311fb96c You are awesome, thank you!
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c index 76072f8..0d57ffc 100644 --- a/drivers/net/ethernet/qlogic/qla3xxx.c +++ b/drivers/net/ethernet/qlogic/qla3xxx.c @@ -2471,6 +2471,7 @@ static netdev_tx_t ql3xxx_send(struct sk_buff *skb, skb_shinfo(skb)->nr_frags); if (tx_cb->seg_count == -1) { netdev_err(ndev, "%s: invalid segment count!\n", __func__); + dev_kfree_skb_any(skb); return NETDEV_TX_OK; }
The ql3xxx_send() returns NETDEV_TX_OK without freeing skb in error handling case, add dev_kfree_skb_any() to fix it. Fixes: bd36b0ac5d06 ("qla3xxx: Add support for Qlogic 4032 chip.") Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> --- drivers/net/ethernet/qlogic/qla3xxx.c | 1 + 1 file changed, 1 insertion(+)