[PATCH] cxgb4: Fix ptp_tx_skb reference leak in cxgb4_eth_xmit()
From: Wentao Liang <hidden>
Date: 2026-09-17 10:57:23
Also in:
lkml, stable
Subsystem:
cxgb4 ethernet driver (cxgb4), networking drivers, the rest · Maintainers:
Potnuri Bharat Teja, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
When PTP is enabled, cxgb4_eth_xmit() takes an extra reference on the
skb and stores it in adap->ptp_tx_skb. If the Tx queue is full the
function returns NETDEV_TX_BUSY, and the remaining error paths jump to
out_free; neither path releases that extra reference, so the skb is
leaked and adap->ptp_tx_skb keeps a stale pointer.
Move the adapter lookup before the first error path so out_free can use
it, then release adap->ptp_tx_skb on both paths.
Fixes: a456950445a0 ("cxgb4: time stamping interface for PTP")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <redacted>
---
drivers/net/ethernet/chelsio/cxgb4/sge.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 9fccb8ea9bcd..5d4c63d9a937 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c@@ -1503,12 +1503,13 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev) unsigned int chip_ver; struct adapter *adap; + pi = netdev_priv(dev); + adap = pi->adapter; + ret = cxgb4_validate_skb(skb, dev, ETH_HLEN); if (ret) goto out_free; - pi = netdev_priv(dev); - adap = pi->adapter; ssi = skb_shinfo(skb); #if IS_ENABLED(CONFIG_CHELSIO_IPSEC_INLINE) if (xfrm_offload(skb) && !ssi->gso_size)
@@ -1553,6 +1554,10 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev) dev_err(adap->pdev_dev, "%s: Tx ring %u full while queue awake!\n", dev->name, qidx); + if (adap->ptp_tx_skb == skb) { + dev_kfree_skb_any(adap->ptp_tx_skb); + adap->ptp_tx_skb = NULL; + } return NETDEV_TX_BUSY; }
@@ -1723,6 +1728,10 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev) return NETDEV_TX_OK; out_free: + if (adap->ptp_tx_skb == skb) { + dev_kfree_skb_any(adap->ptp_tx_skb); + adap->ptp_tx_skb = NULL; + } dev_kfree_skb_any(skb); return NETDEV_TX_OK; }
--
2.34.1