Commit 44c0e191 authored by Thomas Fourier's avatar Thomas Fourier Committed by Ping-Ke Shih
Browse files

wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. 



The function `_rtl_pci_init_one_rxdesc()` can fail even when the new
`skb` is passed because of a DMA mapping error.  If it fails, the `skb`
is not saved in the rx ringbuffer and thus lost.

Compile tested only

Signed-off-by: default avatarThomas Fourier <fourier.thomas@gmail.com>
Acked-by: default avatarPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: default avatarPing-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250616105631.444309-4-fourier.thomas@gmail.com
parent c2852b5a

drivers/net/wireless/realtek/rtlwifi/pci.c

+12 −6
Original line number Diff line number Diff line
@@ -805,13 +805,19 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) 
		skb = new_skb;

no_new:

		if (rtlpriv->use_new_trx_flow) {

			_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,

			if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,

						      rxring_idx,

						 rtlpci->rx_ring[rxring_idx].idx);

						      rtlpci->rx_ring[rxring_idx].idx)) {

				if (new_skb)

					dev_kfree_skb_any(skb);

			}

		} else {

			_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,

			if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,

						      rxring_idx,

						 rtlpci->rx_ring[rxring_idx].idx);

						      rtlpci->rx_ring[rxring_idx].idx)) {

				if (new_skb)

					dev_kfree_skb_any(skb);

			}

			if (rtlpci->rx_ring[rxring_idx].idx ==

			    rtlpci->rxringcount - 1)

				rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,