diff options
| author | Ziyang Xuan <william.xuanziyang@huawei.com> | 2022-11-20 11:54:05 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-11-22 20:16:08 -0800 |
| commit | 3213f808ae21be3891885de2f3a775afafcda987 (patch) | |
| tree | f611e4cfb1c58df300ee3e12f8b092200d0b709f /drivers/net/ethernet/mediatek/mtk_eth_soc.c | |
| parent | 0972457f5803e69e31041c4ceae771bf2438410a (diff) | |
| download | linux-3213f808ae21be3891885de2f3a775afafcda987.tar.gz linux-3213f808ae21be3891885de2f3a775afafcda987.tar.bz2 linux-3213f808ae21be3891885de2f3a775afafcda987.zip | |
net: ethernet: mtk_eth_soc: fix potential memory leak in mtk_rx_alloc()
When fail to dma_map_single() in mtk_rx_alloc(), it returns directly.
But the memory allocated for local variable data is not freed, and
local variabel data has not been attached to ring->data[i] yet, so the
memory allocated for local variable data will not be freed outside
mtk_rx_alloc() too. Thus memory leak would occur in this scenario.
Add skb_free_frag(data) when dma_map_single() failed.
Fixes: 23233e577ef9 ("net: ethernet: mtk_eth_soc: rely on page_pool for single page buffers")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Acked-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Link: https://lore.kernel.org/r/20221120035405.1464341-1-william.xuanziyang@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/ethernet/mediatek/mtk_eth_soc.c')
| -rw-r--r-- | drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c index 1d1f2342e3ec..bbffd92089bf 100644 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c @@ -2378,8 +2378,10 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag) data + NET_SKB_PAD + eth->ip_align, ring->buf_size, DMA_FROM_DEVICE); if (unlikely(dma_mapping_error(eth->dma_dev, - dma_addr))) + dma_addr))) { + skb_free_frag(data); return -ENOMEM; + } } rxd->rxd1 = (unsigned int)dma_addr; ring->data[i] = data; |