From nobody Thu Apr 16 06:50:31 2026 Received: from sg-1-101.ptr.blmpb.com (sg-1-101.ptr.blmpb.com [118.26.132.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07AEE375AC6 for ; Mon, 2 Mar 2026 05:47:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=118.26.132.101 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772430425; cv=none; b=rNVhtqqd8f7cFvhfg7642s/Xwz3/f/pkteoLGzLlEYpG+RXrMHrkmmBvTUX0IOZ6usgC+Hy6Q9cXAK1fq+d598CRMGvT4aeUQ2VPGsiPwsK4+60qdlsHfKr/bxRKiRlD5nEPDWRaQDUhu7bwlGrRjy/7IP6rouzGhlOkkenl3fI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772430425; c=relaxed/simple; bh=FBUj8CXqrMmWiCJ6H5cfj4MYT+crFnEv2ztcbGdjJyQ=; h=Date:From:Mime-Version:Content-Type:To:Subject:Message-Id; b=bRrZKVKM/Fx2oBQQ7/PU3fD6uh5viCHZDMwcoTC3v1WTLr45Cbd3BWDpdazuzCw9LFO6/HFUdOIn9sf+GSmE3M9Jwlovtwt61tzRzVfpxTp9YRDAYgsLMUkL8D6haX+nPdySJCIglRWj9K8brIJn4PzUUcL/R7NGrGqlmnSlP3k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=VUEX2y+d; arc=none smtp.client-ip=118.26.132.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="VUEX2y+d" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=2212171451; d=bytedance.com; t=1772430403; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=D4s3Y/dQGNCVxUUgdzoFPBIj3DOlIkW5R8WMjLUI9yM=; b=VUEX2y+dAFt5rCkT/ocb/U8e+AnrTr3b3+7uKtEGuPXoFD3iLGNCp3Q3D7nH72uUo71Oo4 WLMbbuOhYLbFnglh59xOhw56s6oMMEtLtywSmD3tGQDEsby3Tv006MDDP1l8jHKdVvbWpV O6JbAyul31ZRigF1V9dvQl74EbS5ZjtdBEcTnSZHKw6Z4+5vZepr6T+OiYAzvnoVb+RG1c c2y6YAnR/1ua6mpMo7jkdtKHjXkqgJUIRPVD1VpaAiVAkAvJTebKkwUordlCtt/xRcMpdj JQbWOaNQ4j/iaGKnS+Tc8xDLESy+riH0GdSz0DdVGm3xl66BuVuK8Y7grVh0Pg== Date: Mon, 2 Mar 2026 13:46:29 +0800 X-Mailer: git-send-email 2.20.1 From: "Jian Zhang" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Original-From: Jian Zhang To: "Samuel Mendoza-Jonas" , "Paul Fertser" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Simon Horman" , , Subject: [PATCH net] net: ncsi: fix skb leak in error paths Message-Id: <20260302054629.1347119-1-zhangjian.3032@bytedance.com> Content-Transfer-Encoding: quoted-printable X-Lms-Return-Path: Content-Type: text/plain; charset="utf-8" Early return paths in NCSI RX and AEN handlers fail to release the received skb, resulting in a memory leak. Specifically, ncsi_aen_handler() returns on invalid AEN packets without consuming the skb. Similarly, ncsi_rcv_rsp() exits early when failing to resolve the NCSI device, response handler, or request, leaving the skb unfreed. Signed-off-by: Jian Zhang Reviewed-by: Simon Horman --- net/ncsi/ncsi-aen.c | 3 ++- net/ncsi/ncsi-rsp.c | 16 ++++++++++++---- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c index 62fb1031763d..040a31557201 100644 --- a/net/ncsi/ncsi-aen.c +++ b/net/ncsi/ncsi-aen.c @@ -224,7 +224,8 @@ int ncsi_aen_handler(struct ncsi_dev_priv *ndp, struct = sk_buff *skb) if (!nah) { netdev_warn(ndp->ndev.dev, "Invalid AEN (0x%x) received\n", h->type); - return -ENOENT; + ret =3D -ENOENT; + goto out; } =20 ret =3D ncsi_validate_aen_pkt(h, nah->payload); diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c index 271ec6c3929e..9d3ca1c020b6 100644 --- a/net/ncsi/ncsi-rsp.c +++ b/net/ncsi/ncsi-rsp.c @@ -1176,8 +1176,10 @@ int ncsi_rcv_rsp(struct sk_buff *skb, struct net_dev= ice *dev, /* Find the NCSI device */ nd =3D ncsi_find_dev(orig_dev); ndp =3D nd ? TO_NCSI_DEV_PRIV(nd) : NULL; - if (!ndp) - return -ENODEV; + if (!ndp) { + ret =3D -ENODEV; + goto bail; + } =20 /* Check if it is AEN packet */ hdr =3D (struct ncsi_pkt_hdr *)skb_network_header(skb); @@ -1199,7 +1201,8 @@ int ncsi_rcv_rsp(struct sk_buff *skb, struct net_devi= ce *dev, if (!nrh) { netdev_err(nd->dev, "Received unrecognized packet (0x%x)\n", hdr->type); - return -ENOENT; + ret =3D -ENOENT; + goto bail; } =20 /* Associate with the request */ @@ -1207,7 +1210,8 @@ int ncsi_rcv_rsp(struct sk_buff *skb, struct net_devi= ce *dev, nr =3D &ndp->requests[hdr->id]; if (!nr->used) { spin_unlock_irqrestore(&ndp->lock, flags); - return -ENODEV; + ret =3D -ENODEV; + goto bail; } =20 nr->rsp =3D skb; @@ -1261,4 +1265,8 @@ int ncsi_rcv_rsp(struct sk_buff *skb, struct net_devi= ce *dev, out: ncsi_free_request(nr); return ret; + +bail: + consume_skb(skb); + return ret; } --=20 2.20.1