Re: [PATCH] net: nixge: fix skb leak and missing bail on DMA mapping error

Andrew Lunn
2026-04-27T13:02:52Z

On Mon, Apr 27, 2026 at 02:00:46AM -0400, kernelcoredev wrote:
> When dma_mapping_error() fires during RX buffer refill in nixge_recv(),
> the skb allocated by netdev_alloc_skb_ip_align() is never freed, and
> execution continues writing a corrupt physical address into the hardware
> descriptor ring.
>
> Fix by freeing the skb with dev_kfree_skb() and returning early.
>
> Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev")
>
> Signed-off-by: Bentley Blacketer <sonionwhat@gmail.com>
> ---
> drivers/net/ethernet/ni/nixge.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
> index 230d5ff99..b64e2f355 100644
> --- a/drivers/net/ethernet/ni/nixge.c
> +++ b/drivers/net/ethernet/ni/nixge.c
> @@ -645,8 +645,9 @@ static int nixge_recv(struct net_device *ndev, int budget)
> NIXGE_MAX_JUMBO_FRAME_SIZE,
> DMA_FROM_DEVICE);
> if (dma_mapping_error(ndev->dev.parent, cur_phys)) {
> - /* FIXME: bail out and clean up */
> - netdev_err(ndev, "Failed to map ...\n");
> + netdev_err(ndev, "Failed to map RX buffer\n");
> + dev_kfree_skb(new_skb);
> + return packets;

Please add to the commit message an explanation of how you tested
this. Did you hack dma_mapping_error() so that 1 in 1000 is returned
an error?

Andrew