Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

be2net: fix potential memory leak in be_xmit()

The be_xmit() returns NETDEV_TX_OK without freeing skb
in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it.

Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.")
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Message-ID: <20241015144802.12150-1-wanghai38@huawei.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>

authored by

Wang Hai and committed by
Andrew Lunn
e4dd8bfe 2cb3f56e

+5 -5
+5 -5
drivers/net/ethernet/emulex/benet/be_main.c
··· 1381 1381 be_get_wrb_params_from_skb(adapter, skb, &wrb_params); 1382 1382 1383 1383 wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); 1384 - if (unlikely(!wrb_cnt)) { 1385 - dev_kfree_skb_any(skb); 1386 - goto drop; 1387 - } 1384 + if (unlikely(!wrb_cnt)) 1385 + goto drop_skb; 1388 1386 1389 1387 /* if os2bmc is enabled and if the pkt is destined to bmc, 1390 1388 * enqueue the pkt a 2nd time with mgmt bit set. ··· 1391 1393 BE_WRB_F_SET(wrb_params.features, OS2BMC, 1); 1392 1394 wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); 1393 1395 if (unlikely(!wrb_cnt)) 1394 - goto drop; 1396 + goto drop_skb; 1395 1397 else 1396 1398 skb_get(skb); 1397 1399 } ··· 1405 1407 be_xmit_flush(adapter, txo); 1406 1408 1407 1409 return NETDEV_TX_OK; 1410 + drop_skb: 1411 + dev_kfree_skb_any(skb); 1408 1412 drop: 1409 1413 tx_stats(txo)->tx_drv_drops++; 1410 1414 /* Flush the already enqueued tx requests */