[PATCH] cxgb4: Fix ptp_tx_skb reference leak in cxgb4_eth_xmit()

[Wentao Liang <vulab@iscas.ac.cn>]

When PTP is enabled, cxgb4_eth_xmit() takes an extra reference on the
skb and stores it in adap->ptp_tx_skb. If the Tx queue is full the
function returns NETDEV_TX_BUSY, and the remaining error paths jump to
out_free; neither path releases that extra reference, so the skb is
leaked and adap->ptp_tx_skb keeps a stale pointer.

Move the adapter lookup before the first error path so out_free can use
it, then release adap->ptp_tx_skb on both paths.

Fixes: a456950445a0 ("cxgb4: time stamping interface for PTP")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/chelsio/cxgb4/sge.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 9fccb8ea9bcd..5d4c63d9a937 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -1503,12 +1503,13 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 	unsigned int chip_ver;
 	struct adapter *adap;
 
+	pi = netdev_priv(dev);
+	adap = pi->adapter;
+
 	ret = cxgb4_validate_skb(skb, dev, ETH_HLEN);
 	if (ret)
 		goto out_free;
 
-	pi = netdev_priv(dev);
-	adap = pi->adapter;
 	ssi = skb_shinfo(skb);
 #if IS_ENABLED(CONFIG_CHELSIO_IPSEC_INLINE)
 	if (xfrm_offload(skb) && !ssi->gso_size)
@@ -1553,6 +1554,10 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 		dev_err(adap->pdev_dev,
 			"%s: Tx ring %u full while queue awake!\n",
 			dev->name, qidx);
+		if (adap->ptp_tx_skb == skb) {
+			dev_kfree_skb_any(adap->ptp_tx_skb);
+			adap->ptp_tx_skb = NULL;
+		}
 		return NETDEV_TX_BUSY;
 	}
 
@@ -1723,6 +1728,10 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 	return NETDEV_TX_OK;
 
 out_free:
+	if (adap->ptp_tx_skb == skb) {
+		dev_kfree_skb_any(adap->ptp_tx_skb);
+		adap->ptp_tx_skb = NULL;
+	}
 	dev_kfree_skb_any(skb);
 	return NETDEV_TX_OK;
 }
-- 
2.34.1