wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.

[PATCH rtw-next] wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.

Posted by Thomas Fourier 3 months, 3 weeks ago

The function `_rtl_pci_init_one_rxdesc()` can fail even when the new
`skb` is passed because of a DMA mapping error.  If it fails, the `skb`
is not saved in the rx ringbuffer and thus lost.

Compile tested only

Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
 drivers/net/wireless/realtek/rtlwifi/pci.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index 472072630f8d..d080469264cf 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -805,13 +805,19 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
 		skb = new_skb;
 no_new:
 		if (rtlpriv->use_new_trx_flow) {
-			_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
-						 rxring_idx,
-						 rtlpci->rx_ring[rxring_idx].idx);
+			if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
+						      rxring_idx,
+						      rtlpci->rx_ring[rxring_idx].idx)) {
+				if (new_skb)
+					dev_kfree_skb_any(skb);
+			}
 		} else {
-			_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
-						 rxring_idx,
-						 rtlpci->rx_ring[rxring_idx].idx);
+			if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
+						      rxring_idx,
+						      rtlpci->rx_ring[rxring_idx].idx)) {
+				if (new_skb)
+					dev_kfree_skb_any(skb);
+			}
 			if (rtlpci->rx_ring[rxring_idx].idx ==
 			    rtlpci->rxringcount - 1)
 				rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,
-- 
2.43.0

Re: [PATCH rtw-next] wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.

Posted by Ping-Ke Shih 3 months, 2 weeks ago

Thomas Fourier <fourier.thomas@gmail.com> wrote:

> The function `_rtl_pci_init_one_rxdesc()` can fail even when the new
> `skb` is passed because of a DMA mapping error.  If it fails, the `skb`
> is not saved in the rx ringbuffer and thus lost.
> 
> Compile tested only
> 
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

44c0e191004f wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.

---
https://github.com/pkshih/rtw.git

RE: [PATCH rtw-next] wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.

Posted by Ping-Ke Shih 3 months, 3 weeks ago

Thomas Fourier <fourier.thomas@gmail.com> wrote:
> The function `_rtl_pci_init_one_rxdesc()` can fail even when the new
> `skb` is passed because of a DMA mapping error.  If it fails, the `skb`
> is not saved in the rx ringbuffer and thus lost.
> 
> Compile tested only
> 
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>

Acked-by: Ping-Ke Shih <pkshih@realtek.com>