[PATCH net] net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean

[PATCH net] net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean

[Holger Brunck]

When cleaning up the resources we need to iterate over the
tx_skbuf array to free pending TX messages.

Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC")
Signed-off-by: Holger Brunck <holger.brunck@hitachienergy.com>
---
 drivers/net/wan/fsl_ucc_hdlc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index adf3863463f5..68f78aeabdc3 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -739,6 +739,8 @@ static int uhdlc_open(struct net_device *dev)
 
 static void uhdlc_memclean(struct ucc_hdlc_private *priv)
 {
+	int i;
+
 	qe_muram_free(ioread16be(&priv->ucc_pram->riptr));
 	qe_muram_free(ioread16be(&priv->ucc_pram->tiptr));
 
@@ -769,6 +771,11 @@ static void uhdlc_memclean(struct ucc_hdlc_private *priv)
 	kfree(priv->rx_skbuff);
 	priv->rx_skbuff = NULL;
 
+	for (i = 0; i < TX_BD_RING_LEN) {
+		kfree(priv->tx_skbuff[i]);
+		priv->tx_skbuff[i] = NULL;
+	}
+
 	kfree(priv->tx_skbuff);
 	priv->tx_skbuff = NULL;
 
-- 
2.47.3

Re: [PATCH net] net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean

[Christophe Leroy (CS GROUP)]

Le 04/05/2026 à 18:11, Holger Brunck a écrit :
> When cleaning up the resources we need to iterate over the
> tx_skbuf array to free pending TX messages.
> 
> Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC")
> Signed-off-by: Holger Brunck <holger.brunck@hitachienergy.com>
> ---
>   drivers/net/wan/fsl_ucc_hdlc.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
> index adf3863463f5..68f78aeabdc3 100644
> --- a/drivers/net/wan/fsl_ucc_hdlc.c
> +++ b/drivers/net/wan/fsl_ucc_hdlc.c
> @@ -739,6 +739,8 @@ static int uhdlc_open(struct net_device *dev)
>   
>   static void uhdlc_memclean(struct ucc_hdlc_private *priv)
>   {
> +	int i;
> +
>   	qe_muram_free(ioread16be(&priv->ucc_pram->riptr));
>   	qe_muram_free(ioread16be(&priv->ucc_pram->tiptr));
>   
> @@ -769,6 +771,11 @@ static void uhdlc_memclean(struct ucc_hdlc_private *priv)
>   	kfree(priv->rx_skbuff);
>   	priv->rx_skbuff = NULL;
>   
> +	for (i = 0; i < TX_BD_RING_LEN) {
> +		kfree(priv->tx_skbuff[i]);

I don't think you can just kfree() an skb like this.

I think you have to call dev_kfree_skb_any() instead.

Christophe


> +		priv->tx_skbuff[i] = NULL;
> +	}
> +
>   	kfree(priv->tx_skbuff);
>   	priv->tx_skbuff = NULL;
>   

RE: [PATCH net] net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean

[Holger Brunck]

> 
> Le 04/05/2026 à 18:11, Holger Brunck a écrit :
> > When cleaning up the resources we need to iterate over the tx_skbuf
> > array to free pending TX messages.
> >
> > Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC")
> > Signed-off-by: Holger Brunck <holger.brunck@hitachienergy.com>
> > ---
> >   drivers/net/wan/fsl_ucc_hdlc.c | 7 +++++++
> >   1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/net/wan/fsl_ucc_hdlc.c
> > b/drivers/net/wan/fsl_ucc_hdlc.c index adf3863463f5..68f78aeabdc3
> > 100644
> > --- a/drivers/net/wan/fsl_ucc_hdlc.c
> > +++ b/drivers/net/wan/fsl_ucc_hdlc.c
> > @@ -739,6 +739,8 @@ static int uhdlc_open(struct net_device *dev)
> >
> >   static void uhdlc_memclean(struct ucc_hdlc_private *priv)
> >   {
> > +     int i;
> > +
> >       qe_muram_free(ioread16be(&priv->ucc_pram->riptr));
> >       qe_muram_free(ioread16be(&priv->ucc_pram->tiptr));
> >
> > @@ -769,6 +771,11 @@ static void uhdlc_memclean(struct ucc_hdlc_private
> *priv)
> >       kfree(priv->rx_skbuff);
> >       priv->rx_skbuff = NULL;
> >
> > +     for (i = 0; i < TX_BD_RING_LEN) {
> > +             kfree(priv->tx_skbuff[i]);
> 
> I don't think you can just kfree() an skb like this.
> 
> I think you have to call dev_kfree_skb_any() instead.
> 

yes you are right or at least dev_kfree_skb() as the error handling code in
ucc_hdlc_tx does.

Thanks
Holger

Re: [PATCH net] net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean

[Jakub Kicinski]

On Tue, 5 May 2026 08:33:34 +0000 Holger Brunck wrote:
> > I don't think you can just kfree() an skb like this.
> > 
> > I think you have to call dev_kfree_skb_any() instead.
> 
> yes you are right or at least dev_kfree_skb() as the error handling code in
> ucc_hdlc_tx does.

Please make it clear in the commit message how you discovered
the issue and how you tested your patches.

RE: [PATCH net] net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean

[Holger Brunck]

 > On Tue, 5 May 2026 08:33:34 +0000 Holger Brunck wrote:
> > > I don't think you can just kfree() an skb like this.
> > >
> > > I think you have to call dev_kfree_skb_any() instead.
> >
> > yes you are right or at least dev_kfree_skb() as the error handling
> > code in ucc_hdlc_tx does.
> 
> Please make it clear in the commit message how you discovered the issue and
> how you tested your patches.

currently the driver is broken if you compile it as a module and try to reload it.
The issue was discovered by a sashiko review for a previous patch of me:
 https://sashiko.dev/#/patchset/20260429114208.941011-1-holger.brunck%40hitachienergy.com

Still there are further issues remaining in the driver. I will update the patch and
the commit message.

Best regards
Holger