2021-05-05 14:13:13

by Íñigo Huguet

Subject: [PATCH] net:CXGB4: fix leak if sk_buff is not used

An sk_buff is allocated to send a flow control message, but it's not
sent in all cases: in case the state is not appropiate to send it or if
it can't be enqueued.

In the first of these 2 cases, the sk_buff was discarded but not freed,
producing a memory leak.

Signed-off-by: Íñigo Huguet <[email protected]>
---
drivers/net/ethernet/chelsio/cxgb4/sge.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 256fae15e032..1e5f2edb70cf 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2563,12 +2563,12 @@ int cxgb4_ethofld_send_flowc(struct net_device *dev, u32 eotid, u32 tc)
spin_lock_bh(&eosw_txq->lock);
if (tc != FW_SCHED_CLS_NONE) {
if (eosw_txq->state != CXGB4_EO_STATE_CLOSED)
- goto out_unlock;
+ goto out_free_skb;

next_state = CXGB4_EO_STATE_FLOWC_OPEN_SEND;
} else {
if (eosw_txq->state != CXGB4_EO_STATE_ACTIVE)
- goto out_unlock;
+ goto out_free_skb;

next_state = CXGB4_EO_STATE_FLOWC_CLOSE_SEND;
}
@@ -2604,17 +2604,19 @@ int cxgb4_ethofld_send_flowc(struct net_device *dev, u32 eotid, u32 tc)
eosw_txq_flush_pending_skbs(eosw_txq);

ret = eosw_txq_enqueue(eosw_txq, skb);
- if (ret) {
- dev_consume_skb_any(skb);
- goto out_unlock;
- }
+ if (ret)
+ goto out_free_skb;

eosw_txq->state = next_state;
eosw_txq->flowc_idx = eosw_txq->pidx;
eosw_txq_advance(eosw_txq, 1);
ethofld_xmit(dev, eosw_txq);

-out_unlock:
+ spin_unlock_bh(&eosw_txq->lock);
+ return 0;
+
+out_free_skb:
+ dev_consume_skb_any(skb);
spin_unlock_bh(&eosw_txq->lock);
return ret;
}
--
2.31.1

2021-05-05 21:06:23

by patchwork-bot+netdevbpf

Subject: Re: [PATCH] net:CXGB4: fix leak if sk_buff is not used

Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Wed, 5 May 2021 14:54:50 +0200 you wrote:
> An sk_buff is allocated to send a flow control message, but it's not
> sent in all cases: in case the state is not appropiate to send it or if
> it can't be enqueued.
>
> In the first of these 2 cases, the sk_buff was discarded but not freed,
> producing a memory leak.
>
> [...]

Here is the summary with links:
- net:CXGB4: fix leak if sk_buff is not used
https://git.kernel.org/netdev/net/c/52bfcdd87e83

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html