Hi Fang,
On Mon, Nov 2, 2026 at 9:19 AM Fang Xieyan [off-list ref] wrote:
quoted hunk ↗ jump to hunk
ipc_mux_dl_decode() owns the received skb and frees it after
decoding. However, the early return when skb->data is NULL
bypasses the skb cleanup.
Free the skb through ipc_pcie_kfree_skb() before returning
to ensure that both the DMA mapping and skb are released.
Fixes: 3670970dd8c6 ("net: iosm: shared memory IPC interface")
Reviewed-by: Guanglei Zhu <redacted>
Signed-off-by: Fang Xieyan <redacted>
---
drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
index 0bbd41263cc2..61700688eac9 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
@@ -693,8 +693,10 @@ void ipc_mux_dl_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb)
{
u32 signature;
- if (!skb->data)
+ if (!skb->data) {
Can skb->data ever be NULL in the first place? This looks rather
unusual. If it can happen, please describe what leads to that
situation. Otherwise, the check should simply be removed.
+ ipc_pcie_kfree_skb(ipc_mux->pcie, skb);
return;
+ }
/* Decode the MUX header type. */
signature = le32_to_cpup((__le32 *)skb->data);
--
2.50.1