Skip to content

Commit 44c0e19

Browse files
Thomas-fourierPing-Ke Shih
authored andcommitted
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_rx_interrupt().
The function `_rtl_pci_init_one_rxdesc()` can fail even when the new `skb` is passed because of a DMA mapping error. If it fails, the `skb` is not saved in the rx ringbuffer and thus lost. Compile tested only Signed-off-by: Thomas Fourier <[email protected]> Acked-by: Ping-Ke Shih <[email protected]> Signed-off-by: Ping-Ke Shih <[email protected]> Link: https://patch.msgid.link/[email protected]
1 parent c2852b5 commit 44c0e19

File tree

1 file changed

+12
-6
lines changed
  • drivers/net/wireless/realtek/rtlwifi

1 file changed

+12
-6
lines changed

drivers/net/wireless/realtek/rtlwifi/pci.c

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -805,13 +805,19 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
805805
skb = new_skb;
806806
no_new:
807807
if (rtlpriv->use_new_trx_flow) {
808-
_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
809-
rxring_idx,
810-
rtlpci->rx_ring[rxring_idx].idx);
808+
if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
809+
rxring_idx,
810+
rtlpci->rx_ring[rxring_idx].idx)) {
811+
if (new_skb)
812+
dev_kfree_skb_any(skb);
813+
}
811814
} else {
812-
_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
813-
rxring_idx,
814-
rtlpci->rx_ring[rxring_idx].idx);
815+
if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
816+
rxring_idx,
817+
rtlpci->rx_ring[rxring_idx].idx)) {
818+
if (new_skb)
819+
dev_kfree_skb_any(skb);
820+
}
815821
if (rtlpci->rx_ring[rxring_idx].idx ==
816822
rtlpci->rxringcount - 1)
817823
rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,

0 commit comments

Comments
 (0)