[PATCH net v3] net: wwan: t7xx: check skb_clone in control TX

[PATCH net v3] net: wwan: t7xx: check skb_clone in control TX

[Ruoyu Wang]

t7xx_port_ctrl_tx() clones each skb fragment before passing it to the
port transmit path. The clone is used immediately to set cloned->len, so
an skb_clone() failure results in a NULL pointer dereference.

Check the clone before using it. If previous fragments were already
queued, preserve the driver's existing partial-write behavior by
returning the number of bytes submitted so far.

Fixes: 36bd28c1cb0d ("wwan: core: Support slicing in port TX flow of WWAN subsystem")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
Changes in v3:
- Preserve the partial-write return value when skb_clone() fails after
  earlier fragments were submitted.

Changes in v2:
- Add Fixes tag.
- Return -ENOMEM consistently on skb_clone() failure.

 drivers/net/wwan/t7xx/t7xx_port_wwan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wwan/t7xx/t7xx_port_wwan.c b/drivers/net/wwan/t7xx/t7xx_port_wwan.c
index 7fc569565..d2529df75 100644
--- a/drivers/net/wwan/t7xx/t7xx_port_wwan.c
+++ b/drivers/net/wwan/t7xx/t7xx_port_wwan.c
@@ -106,6 +106,8 @@ static int t7xx_port_ctrl_tx(struct t7xx_port *port, struct sk_buff *skb)
 
 	while (cur) {
 		cloned = skb_clone(cur, GFP_KERNEL);
+		if (!cloned)
+			return cnt ? cnt : -ENOMEM;
 		cloned->len = skb_headlen(cur);
 		ret = t7xx_port_send_skb(port, cloned, 0, 0);
 		if (ret) {
-- 
2.51.0

Re: [PATCH net v3] net: wwan: t7xx: check skb_clone in control TX

[Loic Poulain]

On Fri, Jun 12, 2026 at 5:56 AM Ruoyu Wang <ruoyuw560@gmail.com> wrote:
>
> t7xx_port_ctrl_tx() clones each skb fragment before passing it to the
> port transmit path. The clone is used immediately to set cloned->len, so
> an skb_clone() failure results in a NULL pointer dereference.
>
> Check the clone before using it. If previous fragments were already
> queued, preserve the driver's existing partial-write behavior by
> returning the number of bytes submitted so far.
>
> Fixes: 36bd28c1cb0d ("wwan: core: Support slicing in port TX flow of WWAN subsystem")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>

Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>

> ---
> Changes in v3:
> - Preserve the partial-write return value when skb_clone() fails after
>   earlier fragments were submitted.
>
> Changes in v2:
> - Add Fixes tag.
> - Return -ENOMEM consistently on skb_clone() failure.
>
>  drivers/net/wwan/t7xx/t7xx_port_wwan.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/wwan/t7xx/t7xx_port_wwan.c b/drivers/net/wwan/t7xx/t7xx_port_wwan.c
> index 7fc569565..d2529df75 100644
> --- a/drivers/net/wwan/t7xx/t7xx_port_wwan.c
> +++ b/drivers/net/wwan/t7xx/t7xx_port_wwan.c
> @@ -106,6 +106,8 @@ static int t7xx_port_ctrl_tx(struct t7xx_port *port, struct sk_buff *skb)
>
>         while (cur) {
>                 cloned = skb_clone(cur, GFP_KERNEL);
> +               if (!cloned)
> +                       return cnt ? cnt : -ENOMEM;
>                 cloned->len = skb_headlen(cur);
>                 ret = t7xx_port_send_skb(port, cloned, 0, 0);
>                 if (ret) {
> --
> 2.51.0
>

Re: [PATCH net v3] net: wwan: t7xx: check skb_clone in control TX

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 12 Jun 2026 11:56:13 +0800 you wrote:
> t7xx_port_ctrl_tx() clones each skb fragment before passing it to the
> port transmit path. The clone is used immediately to set cloned->len, so
> an skb_clone() failure results in a NULL pointer dereference.
> 
> Check the clone before using it. If previous fragments were already
> queued, preserve the driver's existing partial-write behavior by
> returning the number of bytes submitted so far.
> 
> [...]

Here is the summary with links:
  - [net,v3] net: wwan: t7xx: check skb_clone in control TX
    https://git.kernel.org/netdev/net/c/05f789fa90d9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html