From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F31BC4332F for ; Mon, 14 Nov 2022 10:44:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236255AbiKNKol (ORCPT ); Mon, 14 Nov 2022 05:44:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236615AbiKNKoS (ORCPT ); Mon, 14 Nov 2022 05:44:18 -0500 X-Greylist: delayed 200 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Mon, 14 Nov 2022 02:44:04 PST Received: from violet.fr.zoreil.com (violet.fr.zoreil.com [IPv6:2001:4b98:dc0:41:216:3eff:fe56:8398]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74D5C2BD for ; Mon, 14 Nov 2022 02:44:04 -0800 (PST) Received: from violet.fr.zoreil.com ([127.0.0.1]) by violet.fr.zoreil.com (8.17.1/8.17.1) with ESMTP id 2AEAe5Uf820655; Mon, 14 Nov 2022 11:40:05 +0100 DKIM-Filter: OpenDKIM Filter v2.11.0 violet.fr.zoreil.com 2AEAe5Uf820655 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fr.zoreil.com; s=v20220413; t=1668422406; bh=ruWxN85n8k29Oly4aD/onyXwm+G1dWEBNEhULwlWsj8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=MNdO/JPQFntF+lJh71QYeQvRSnzPu2iIdkEZFKzTecVnv9ySF5yMUZRnlhLszeD40 RXnLdCfCGSFXL4iVD79orRyWYf82BhNmZ5ErPLwa2HpA1BLLM6tyQXoFJ+W+e5GcU7 i2PWMXF3YHSvgxGyuu6IE3ys4rETYBVou2LGGV6M= Received: (from romieu@localhost) by violet.fr.zoreil.com (8.17.1/8.17.1/Submit) id 2AEAe4Hp820654; Mon, 14 Nov 2022 11:40:04 +0100 Date: Mon, 14 Nov 2022 11:40:04 +0100 From: Francois Romieu To: Zhang Changzhong Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Moritz Fischer , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH net] net: nixge: fix potential memory leak in nixge_start_xmit() Message-ID: References: <1668416136-33530-1-git-send-email-zhangchangzhong@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1668416136-33530-1-git-send-email-zhangchangzhong@huawei.com> X-Organisation: Land of Sunshine Inc. Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Zhang Changzhong : > The nixge_start_xmit() returns NETDEV_TX_OK but does not free skb on two > error handling cases, which can lead to memory leak. > > To fix this, return NETDEV_TX_BUSY in case of nixge_check_tx_bd_space() > fails and add dev_kfree_skb_any() in case of dma_map_single() fails. This patch merge two unrelated changes. Please split. > Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev") > Signed-off-by: Zhang Changzhong > --- > drivers/net/ethernet/ni/nixge.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c > index 19d043b593cc..b9091f9bbc77 100644 > --- a/drivers/net/ethernet/ni/nixge.c > +++ b/drivers/net/ethernet/ni/nixge.c > @@ -521,13 +521,15 @@ static netdev_tx_t nixge_start_xmit(struct sk_buff *skb, > if (nixge_check_tx_bd_space(priv, num_frag)) { > if (!netif_queue_stopped(ndev)) > netif_stop_queue(ndev); > - return NETDEV_TX_OK; > + return NETDEV_TX_BUSY; > } The driver should probably check the available room before returning from hard_start_xmit and turn the check above unlikely(). Btw there is no lock and the Tx completion is irq driven: the driver is racy. :o( -- Ueimor