[PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[Yun Lu]

From: Yun Lu <luyun@kylinos.cn>

In rtase_start_xmit(), when the head buffer DMA mapping fails after
rtase_xmit_frags() has mapped all fragments, the error path clears
the fragment descriptors with rtase_tx_clear_range(), which frees
the skb through the last-frag slot and accounts tx_dropped. Control
then falls through to the common error label, which frees the same
skb a second time and counts it again.

Return right after clearing the fragments when the skb owns frags;
the no-frag case still drops through and frees the head skb once.

Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function")
Signed-off-by: Yun Lu <luyun@kylinos.cn>
---
 drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/realtek/rtase/rtase_main.c b/drivers/net/ethernet/realtek/rtase/rtase_main.c
index 255667775f0e..67f7fdada119 100644
--- a/drivers/net/ethernet/realtek/rtase/rtase_main.c
+++ b/drivers/net/ethernet/realtek/rtase/rtase_main.c
@@ -1426,6 +1426,9 @@ static netdev_tx_t rtase_start_xmit(struct sk_buff *skb,
 err_dma_1:
 	ring->skbuff[entry] = NULL;
 	rtase_tx_clear_range(ring, ring->cur_idx + 1, frags);
+	if (frags)
+		/* the frags were cleared above, along with the skb */
+		return NETDEV_TX_OK;
 
 err_dma_0:
 	tp->stats.tx_dropped++;
-- 
2.43.0

Re: [PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[Jacob Keller]

On 7/20/2026 7:38 PM, Yun Lu wrote:
> From: Yun Lu <luyun@kylinos.cn>
> 
> In rtase_start_xmit(), when the head buffer DMA mapping fails after
> rtase_xmit_frags() has mapped all fragments, the error path clears
> the fragment descriptors with rtase_tx_clear_range(), which frees
> the skb through the last-frag slot and accounts tx_dropped. Control
> then falls through to the common error label, which frees the same
> skb a second time and counts it again.
> 
> Return right after clearing the fragments when the skb owns frags;
> the no-frag case still drops through and frees the head skb once.
> 
> Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function")
> Signed-off-by: Yun Lu <luyun@kylinos.cn>
> ---
>  drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/ethernet/realtek/rtase/rtase_main.c b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> index 255667775f0e..67f7fdada119 100644
> --- a/drivers/net/ethernet/realtek/rtase/rtase_main.c
> +++ b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> @@ -1426,6 +1426,9 @@ static netdev_tx_t rtase_start_xmit(struct sk_buff *skb,
>  err_dma_1:
>  	ring->skbuff[entry] = NULL;
>  	rtase_tx_clear_range(ring, ring->cur_idx + 1, frags);
> +	if (frags)
> +		/* the frags were cleared above, along with the skb */
> +		return NETDEV_TX_OK;
>  

This feels a bit strange, but it matches the code in
rtase_tx_clear_range. I do find it a bit odd we're checking frags here
even though they got freed.. but it does seem to check out with how the
rtase_tx_clear_range() works.

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

>  err_dma_0:
>  	tp->stats.tx_dropped++;