[PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[Yun Lu]

From: Yun Lu <luyun@kylinos.cn>

In rtase_start_xmit(), when the head buffer DMA mapping fails after
rtase_xmit_frags() has mapped all fragments, the error path clears
the fragment descriptors with rtase_tx_clear_range(), which frees
the skb through the last-frag slot and accounts tx_dropped. Control
then falls through to the common error label, which frees the same
skb a second time and counts it again.

Return right after clearing the fragments when the skb owns frags;
the no-frag case still drops through and frees the head skb once.

Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function")
Signed-off-by: Yun Lu <luyun@kylinos.cn>
---
 drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/realtek/rtase/rtase_main.c b/drivers/net/ethernet/realtek/rtase/rtase_main.c
index 255667775f0e..67f7fdada119 100644
--- a/drivers/net/ethernet/realtek/rtase/rtase_main.c
+++ b/drivers/net/ethernet/realtek/rtase/rtase_main.c
@@ -1426,6 +1426,9 @@ static netdev_tx_t rtase_start_xmit(struct sk_buff *skb,
 err_dma_1:
 	ring->skbuff[entry] = NULL;
 	rtase_tx_clear_range(ring, ring->cur_idx + 1, frags);
+	if (frags)
+		/* the frags were cleared above, along with the skb */
+		return NETDEV_TX_OK;
 
 err_dma_0:
 	tp->stats.tx_dropped++;
-- 
2.43.0

Re: [PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[Jacob Keller]

On 7/20/2026 7:38 PM, Yun Lu wrote:
> From: Yun Lu <luyun@kylinos.cn>
> 
> In rtase_start_xmit(), when the head buffer DMA mapping fails after
> rtase_xmit_frags() has mapped all fragments, the error path clears
> the fragment descriptors with rtase_tx_clear_range(), which frees
> the skb through the last-frag slot and accounts tx_dropped. Control
> then falls through to the common error label, which frees the same
> skb a second time and counts it again.
> 
> Return right after clearing the fragments when the skb owns frags;
> the no-frag case still drops through and frees the head skb once.
> 
> Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function")
> Signed-off-by: Yun Lu <luyun@kylinos.cn>
> ---
>  drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/ethernet/realtek/rtase/rtase_main.c b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> index 255667775f0e..67f7fdada119 100644
> --- a/drivers/net/ethernet/realtek/rtase/rtase_main.c
> +++ b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> @@ -1426,6 +1426,9 @@ static netdev_tx_t rtase_start_xmit(struct sk_buff *skb,
>  err_dma_1:
>  	ring->skbuff[entry] = NULL;
>  	rtase_tx_clear_range(ring, ring->cur_idx + 1, frags);
> +	if (frags)
> +		/* the frags were cleared above, along with the skb */
> +		return NETDEV_TX_OK;
>  

This feels a bit strange, but it matches the code in
rtase_tx_clear_range. I do find it a bit odd we're checking frags here
even though they got freed.. but it does seem to check out with how the
rtase_tx_clear_range() works.

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

>  err_dma_0:
>  	tp->stats.tx_dropped++;

Re: [PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[Jakub Kicinski]

On Tue, 21 Jul 2026 10:38:36 +0800 Yun Lu wrote:
> From: Yun Lu <luyun@kylinos.cn>
> 
> In rtase_start_xmit(), when the head buffer DMA mapping fails after
> rtase_xmit_frags() has mapped all fragments, the error path clears
> the fragment descriptors with rtase_tx_clear_range(), which frees
> the skb through the last-frag slot and accounts tx_dropped. Control
> then falls through to the common error label, which frees the same
> skb a second time and counts it again.
> 
> Return right after clearing the fragments when the skb owns frags;
> the no-frag case still drops through and frees the head skb once.
> 
> Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function")
> Signed-off-by: Yun Lu <luyun@kylinos.cn>

Justin, please review.

> diff --git a/drivers/net/ethernet/realtek/rtase/rtase_main.c b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> index 255667775f0e..67f7fdada119 100644
> --- a/drivers/net/ethernet/realtek/rtase/rtase_main.c
> +++ b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> @@ -1426,6 +1426,9 @@ static netdev_tx_t rtase_start_xmit(struct sk_buff *skb,
>  err_dma_1:
>  	ring->skbuff[entry] = NULL;
>  	rtase_tx_clear_range(ring, ring->cur_idx + 1, frags);
> +	if (frags)
> +		/* the frags were cleared above, along with the skb */
> +		return NETDEV_TX_OK;
>  
>  err_dma_0:
>  	tp->stats.tx_dropped++;

RE: [PATCH] rtase: fix double free of multi-frag skb on DMA map failure

[Justin Lai]

Jakub Kicinski <kuba@kernel.org> wrote:
> 
> On Tue, 21 Jul 2026 10:38:36 +0800 Yun Lu wrote:
> > From: Yun Lu <luyun@kylinos.cn>
> >
> > In rtase_start_xmit(), when the head buffer DMA mapping fails after
> > rtase_xmit_frags() has mapped all fragments, the error path clears the
> > fragment descriptors with rtase_tx_clear_range(), which frees the skb
> > through the last-frag slot and accounts tx_dropped. Control then falls
> > through to the common error label, which frees the same skb a second
> > time and counts it again.
> >
> > Return right after clearing the fragments when the skb owns frags; the
> > no-frag case still drops through and frees the head skb once.
> >
> > Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function")
> > Signed-off-by: Yun Lu <luyun@kylinos.cn>
> 
> Justin, please review.
> 
> > diff --git a/drivers/net/ethernet/realtek/rtase/rtase_main.c
> > b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> > index 255667775f0e..67f7fdada119 100644
> > --- a/drivers/net/ethernet/realtek/rtase/rtase_main.c
> > +++ b/drivers/net/ethernet/realtek/rtase/rtase_main.c
> > @@ -1426,6 +1426,9 @@ static netdev_tx_t rtase_start_xmit(struct
> > sk_buff *skb,
> >  err_dma_1:
> >       ring->skbuff[entry] = NULL;
> >       rtase_tx_clear_range(ring, ring->cur_idx + 1, frags);
> > +     if (frags)
> > +             /* the frags were cleared above, along with the skb */
> > +             return NETDEV_TX_OK;
> >
> >  err_dma_0:
> >       tp->stats.tx_dropped++;

Reviewed-by: Justin Lai <justinlai0215@realtek.com>