Re: [PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[Jakub Kicinski <kuba@kernel.org>]

On Tue, 21 Jul 2026 10:38:36 +0800 Yun Lu wrote:
> From: Yun Lu <luyun@kylinos.cn>
> 
> In rtase_start_xmit(), when the head buffer DMA mapping fails after
> rtase_xmit_frags() has mapped all fragments, the error path clears
> the fragment descriptors with rtase_tx_clear_range(), which frees
> the skb through the last-frag slot and accounts tx_dropped. Control
> then falls through to the common error label, which frees the same
> skb a second time and counts it again.
> 
> Return right after clearing the fragments when the skb owns frags;
> the no-frag case still drops through and frees the head skb once.
> 
> Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function")
> Signed-off-by: Yun Lu <luyun@kylinos.cn>

Justin, please review.

> diff --git a/drivers/net/ethernet/realtek/rtase/rtase_main.c b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> index 255667775f0e..67f7fdada119 100644
> --- a/drivers/net/ethernet/realtek/rtase/rtase_main.c
> +++ b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> @@ -1426,6 +1426,9 @@ static netdev_tx_t rtase_start_xmit(struct sk_buff *skb,
>  err_dma_1:
>  	ring->skbuff[entry] = NULL;
>  	rtase_tx_clear_range(ring, ring->cur_idx + 1, frags);
> +	if (frags)
> +		/* the frags were cleared above, along with the skb */
> +		return NETDEV_TX_OK;
>  
>  err_dma_0:
>  	tp->stats.tx_dropped++;