[PATCH net v1 0/3] net: fix stale TX skb pointers on DMA map failure

[xuanqiang.luo@linux.dev]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

While I was backporting commit 1a303baa715e6 ("ice: fix double-free of
tx_buf skb"), an AI-assisted scan identified several suspected TX error
paths. I reviewed the results and found this issue in the three drivers
fixed here.

The drivers differ, but the bug is the same. On a DMA mapping failure, the
TX path frees an skb while its ring entry still points to it. A later
transmission normally overwrites the entry. If the interface is stopped
first, teardown can instead access or free the skb again.

I do not have these adapters, so I have not tested the drivers on hardware.
I checked the error and teardown paths by inspection. Still, these small
fixes seem worth posting for review. They are independent, but are sent as
one series because they address the same issue.

Xuanqiang Luo (3):
  bna: fix use-after-free on DMA mapping failure
  hinic3: fix use-after-free on DMA mapping failure
  net: hibmcge: fix double-free of tx skb on DMA mapping failure

 drivers/net/ethernet/brocade/bna/bnad.c           | 2 +-
 drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 1 +
 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c    | 5 +++--
 3 files changed, 5 insertions(+), 3 deletions(-)

-- 
2.43.0