Re: [PATCH net v1 3/3] net: hibmcge: fix double-free of tx skb on DMA mapping failure
From: Jijie Shao <shaojijie@huawei.com>
Date: 2026-07-10 10:15:17
Also in:
lkml, stable
on 2026/7/10 17:05, xuanqiang.luo@linux.dev wrote:
From: Xuanqiang Luo <redacted>
If hbg_dma_map() fails, hbg_net_start_xmit() frees the skb, but buffer->skb
is left pointing to it. ring->ntu is not advanced, so the buffer is not
visible to the TX cleanup path.
A subsequent transmit normally overwrites the buffer. However, if the
interface is brought down first, hbg_ring_uninit() calls hbg_buffer_free().
It sees the stale pointer, attempts to unmap the failed mapping, and frees
the skb again.
Clear buffer->skb before freeing the skb in the error path, preventing
hbg_buffer_free() from treating it as an outstanding TX buffer.
Fixes: 40735e7543f9 ("net: hibmcge: Implement .ndo_start_xmit function")
Cc: stable@vger.kernel.org
Assisted-by: Opencode:deepseek-v4-pro[1m]
Signed-off-by: Xuanqiang Luo <redacted>Thanks for fixing this. The patch looks good to me. Reviewed-by: Jijie Shao <shaojijie@huawei.com>
quoted hunk ↗ jump to hunk
--- drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 1 + 1 file changed, 1 insertion(+)diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c index 0ae3149946769..4382af937e2e7 100644 --- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c +++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c@@ -155,6 +155,7 @@ netdev_tx_t hbg_net_start_xmit(struct sk_buff *skb, struct net_device *netdev) buffer->skb = skb; buffer->skb_len = skb->len; if (unlikely(hbg_dma_map(buffer))) { + buffer->skb = NULL; dev_kfree_skb_any(skb); return NETDEV_TX_OK; }