ntb_process_tx() handles an oversized buffer by calling tx_handler()
with a NULL data pointer, returning the queue entry to tx_free_q, and
returning success. ntb_netdev therefore neither frees the skb from the
callback nor takes its enqueue error path, leaking it.
Return -EMSGSIZE instead. ntb_transport_tx_enqueue() puts the acquired
queue entry back on tx_free_q when ntb_process_tx() fails, while the
caller retains ownership of the rejected buffer.
Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
Signed-off-by: Koichiro Den <redacted>
---
drivers/ntb/ntb_transport.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 3efc50955253..3a9635faad9e 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1962,14 +1962,8 @@ static int ntb_process_tx(struct ntb_transport_qp *qp,
return -EAGAIN;
}
- if (entry->len > qp->tx_max_frame - sizeof(struct ntb_payload_header)) {
- if (qp->tx_handler)
- qp->tx_handler(qp, qp->cb_data, NULL, -EIO);
-
- ntb_list_add(&qp->ntb_tx_free_q_lock, &entry->entry,
- &qp->tx_free_q);
- return 0;
- }
+ if (entry->len > qp->tx_max_frame - sizeof(struct ntb_payload_header))
+ return -EMSGSIZE;
ntb_async_tx(qp, entry);
--
2.51.0