Re: [PATCH net] idpf: free the skb on TX DMA mapping errors

[Alexander Lobakin <aleksander.lobakin@intel.com>]

From: Alexander Lobakin <aleksander.lobakin@intel.com>
Date: Fri, 30 Oct 2026 16:35:21 +0100

> From: Mina Almasry <almasrymina@google.com>
> Date: Sat, 24 Oct 2026 03:04:01 +0000
> 
>> From: Naman Gulati <namangulati@google.com>
>>
>> When a DMA mapping fails in idpf_tx_splitq_map() or
>> idpf_tx_singleq_map(), the unwind walks the buffers with
>> libeth_tx_complete(). The first buffer is still typed LIBETH_SQE_FRAG
>> (or LIBETH_SQE_EMPTY if the linear data mapping itself failed) at that
>> point, so it is only unmapped and the skb is never freed. The callers
>> return NETDEV_TX_OK and do not touch the skb either, so it leaks.
>>
>> Free the skb at the end of the unwind.
>>
>> Fixes: d9028db618a6 ("idpf: convert to libeth Tx buffer completion")
>> Signed-off-by: Naman Gulati <namangulati@google.com>
>> Signed-off-by: Mina Almasry <almasrymina@google.com>
>> ---
>>  drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | 2 ++
>>  drivers/net/ethernet/intel/idpf/idpf_txrx.c         | 3 +++
>>  2 files changed, 5 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
>> index e3ddf18dcbf51..010903260ff6f 100644
>> --- a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
>> +++ b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
>> @@ -228,6 +228,8 @@ static void idpf_tx_singleq_dma_map_error(struct idpf_tx_queue *txq,
>>  
>>  	/* Update tail in case netdev_xmit_more was previously true */
>>  	idpf_tx_buf_hw_update(txq, idx, false);
>> +
>> +	dev_kfree_skb_any(skb);
>>  }
>>  
>>  /**
>> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
>> index 885df6294ad94..a92e2457781e6 100644
>> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
>> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
>> @@ -2606,6 +2606,7 @@ static void idpf_tx_splitq_pkt_err_unmap(struct idpf_tx_queue *txq,
>>  	struct idpf_sw_queue *refillq = txq->refillq;
>>  	struct libeth_sq_napi_stats ss = { };
>>  	struct idpf_tx_buf *tx_buf = first;
>> +	struct sk_buff *skb = first->skb;
>>  	struct libeth_cq_pp cp = {
>>  		.dev    = txq->dev,
>>  		.ss     = &ss,
>> @@ -2621,6 +2622,8 @@ static void idpf_tx_splitq_pkt_err_unmap(struct idpf_tx_queue *txq,
>>  		libeth_tx_complete(tx_buf, &cp);
>>  	}
>>  
>> +	dev_kfree_skb_any(skb);
> 
> libeth_tx_complete() frees the skb.
> Before this loop, it's called on @first.

Sorry, me not reading the commit messages.
If at this point, the SQE is still not `_SKB`, then

Acked-by: Alexander Lobakin <aleksander.lobakin@intel.com>

Thanks!
> 
>> +
>>  	/* Update tail in case netdev_xmit_more was previously true. */
>>  	idpf_tx_buf_hw_update(txq, params->prev_ntu, false);
>>  
>>
>> base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
Olek