Re: [PATCH net v1 3/3] net: hibmcge: fix double-free of tx skb on DMA mapping failure

[Jijie Shao <shaojijie@huawei.com>]

on 2026/7/10 17:05, xuanqiang.luo@linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> If hbg_dma_map() fails, hbg_net_start_xmit() frees the skb, but buffer->skb
> is left pointing to it. ring->ntu is not advanced, so the buffer is not
> visible to the TX cleanup path.
>
> A subsequent transmit normally overwrites the buffer. However, if the
> interface is brought down first, hbg_ring_uninit() calls hbg_buffer_free().
> It sees the stale pointer, attempts to unmap the failed mapping, and frees
> the skb again.
>
> Clear buffer->skb before freeing the skb in the error path, preventing
> hbg_buffer_free() from treating it as an outstanding TX buffer.
>
> Fixes: 40735e7543f9 ("net: hibmcge: Implement .ndo_start_xmit function")
> Cc: stable@vger.kernel.org
> Assisted-by: Opencode:deepseek-v4-pro[1m]
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Thanks for fixing this. The patch looks good to me.

Reviewed-by: Jijie Shao <shaojijie@huawei.com>

> ---
>   drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c
> index 0ae3149946769..4382af937e2e7 100644
> --- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c
> +++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c
> @@ -155,6 +155,7 @@ netdev_tx_t hbg_net_start_xmit(struct sk_buff *skb, struct net_device *netdev)
>   	buffer->skb = skb;
>   	buffer->skb_len = skb->len;
>   	if (unlikely(hbg_dma_map(buffer))) {
> +		buffer->skb = NULL;
>   		dev_kfree_skb_any(skb);
>   		return NETDEV_TX_OK;
>   	}