]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
authorThomas Fourier <fourier.thomas@gmail.com>
Fri, 13 Jun 2025 07:38:36 +0000 (09:38 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Aug 2025 16:41:19 +0000 (18:41 +0200)
[ Upstream commit 76b3e5078d76f0eeadb7aacf9845399f8473da0d ]

When `dma_mapping_error()` is true, if a new `skb` has been allocated,
then it must be de-allocated.

Compile tested only

Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250613074014.69856-2-fourier.thomas@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/realtek/rtlwifi/pci.c

index 2741c3beac4ca2bafb1385193cd0037a7848a3bd..d080469264cf89eb96cf75304c946d2388421586 100644 (file)
@@ -572,8 +572,11 @@ remap:
                dma_map_single(&rtlpci->pdev->dev, skb_tail_pointer(skb),
                               rtlpci->rxbuffersize, DMA_FROM_DEVICE);
        bufferaddress = *((dma_addr_t *)skb->cb);
-       if (dma_mapping_error(&rtlpci->pdev->dev, bufferaddress))
+       if (dma_mapping_error(&rtlpci->pdev->dev, bufferaddress)) {
+               if (!new_skb)
+                       kfree_skb(skb);
                return 0;
+       }
        rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
        if (rtlpriv->use_new_trx_flow) {
                /* skb->cb may be 64 bit address */