Re: [PATCH net v1 2/3] hinic3: fix use-after-free on DMA mapping failure
From: Fan Gong <gongfan1@huawei.com>
Date: 2026-07-20 13:36:32
Also in:
lkml, stable
quoted hunk ↗ jump to hunk
drivers/net/ethernet/huawei/hinic3/hinic3_tx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c index 9306bf0020caf..5739ecb08d0d3 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c@@ -578,8 +578,6 @@ static netdev_tx_t hinic3_send_one_skb(struct sk_buff *skb, *wqe_combo.task = task; tx_info = &txq->tx_info[pi]; - tx_info->skb = skb; - tx_info->wqebb_cnt = wqebb_cnt; err = hinic3_tx_map_skb(netdev, skb, txq, tx_info, &wqe_combo); if (err) {@@ -589,6 +587,9 @@ static netdev_tx_t hinic3_send_one_skb(struct sk_buff *skb, goto err_drop_pkt; } + tx_info->skb = skb; + tx_info->wqebb_cnt = wqebb_cnt; + netif_subqueue_sent(netdev, txq->sq->q_id, skb->len); netif_subqueue_maybe_stop(netdev, txq->sq->q_id, hinic3_wq_free_wqebbs(&txq->sq->wq),
Thanks for your fixes, the proposed modification of the hinic3 driver has been tested on hardware, and it works fine. Reviewed-by: Fan Gong <gongfan1@huawei.com>