[PATCH net-next] net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

[PATCH net-next] net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

[Yi Cong]

From: Yi Cong <yicong@kylinos.cn>

When the interface has NETIF_F_SG enabled and skb_linearize() fails in
ax88179_tx_fixup(), the function returns NULL without freeing the skb.

usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop
(info->flags does not set FLAG_MULTI_PACKET for this driver), jumping
to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`.
Because tx_fixup() returned NULL, the local skb variable in
usbnet_start_xmit() is NULL, so the original skb is never freed — a
memory leak on every TX frame whose linearization fails (i.e. under
memory pressure).

Free the skb before returning, matching the error handling already used
for the pskb_expand_head() failure path in the same function.

Fixes: 16b1c4e01c89 ("net: usb: ax88179_178a: add TSO feature")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Cong <yicong@kylinos.cn>
---
 drivers/net/usb/ax88179_178a.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 98f899ea2e94..81d8412ce8e2 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1487,8 +1487,10 @@ ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
 
 	headroom = skb_headroom(skb) - 8;
 
-	if ((dev->net->features & NETIF_F_SG) && skb_linearize(skb))
+	if ((dev->net->features & NETIF_F_SG) && skb_linearize(skb)) {
+		dev_kfree_skb_any(skb);
 		return NULL;
+	}
 
 	if ((skb_header_cloned(skb) || headroom < 0) &&
 	    pskb_expand_head(skb, headroom < 0 ? 8 : 0, 0, GFP_ATOMIC)) {
-- 
2.25.1

Re: [PATCH net-next] net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 29 Jul 2026 11:04:36 +0800 you wrote:
> From: Yi Cong <yicong@kylinos.cn>
> 
> When the interface has NETIF_F_SG enabled and skb_linearize() fails in
> ax88179_tx_fixup(), the function returns NULL without freeing the skb.
> 
> usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop
> (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping
> to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`.
> Because tx_fixup() returned NULL, the local skb variable in
> usbnet_start_xmit() is NULL, so the original skb is never freed — a
> memory leak on every TX frame whose linearization fails (i.e. under
> memory pressure).
> 
> [...]

Here is the summary with links:
  - [net-next] net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
    https://git.kernel.org/netdev/net/c/1f428e309473

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html