| Message ID | 20221117065527.71103-1-wanghai38@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 2360f9b8c4e81d242d4cbf99d630a2fffa681fab |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() | expand |
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Thu, 17 Nov 2022 14:55:27 +0800 you wrote: > In pch_gbe_xmit_frame(), NETDEV_TX_OK will be returned whether > pch_gbe_tx_queue() sends data successfully or not, so pch_gbe_tx_queue() > needs to free skb before returning. But pch_gbe_tx_queue() returns without > freeing skb in case of dma_map_single() fails. Add dev_kfree_skb_any() > to fix it. > > Fixes: 77555ee72282 ("net: Add Gigabit Ethernet driver of Topcliff PCH") > Signed-off-by: Wang Hai <wanghai38@huawei.com> > > [...] Here is the summary with links: - [net] net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() https://git.kernel.org/netdev/net/c/2360f9b8c4e8 You are awesome, thank you!
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c index 3f2c30184752..c9ae47128a07 100644 --- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c @@ -1143,6 +1143,7 @@ static void pch_gbe_tx_queue(struct pch_gbe_adapter *adapter, buffer_info->dma = 0; buffer_info->time_stamp = 0; tx_ring->next_to_use = ring_num; + dev_kfree_skb_any(skb); return; } buffer_info->mapped = true;
In pch_gbe_xmit_frame(), NETDEV_TX_OK will be returned whether pch_gbe_tx_queue() sends data successfully or not, so pch_gbe_tx_queue() needs to free skb before returning. But pch_gbe_tx_queue() returns without freeing skb in case of dma_map_single() fails. Add dev_kfree_skb_any() to fix it. Fixes: 77555ee72282 ("net: Add Gigabit Ethernet driver of Topcliff PCH") Signed-off-by: Wang Hai <wanghai38@huawei.com> --- drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 1 + 1 file changed, 1 insertion(+)