wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.

[ Upstream commit 44c0e191004f0e3aa1bdee3be248be14dbe5b020 ]

The function `_rtl_pci_init_one_rxdesc()` can fail even when the new
`skb` is passed because of a DMA mapping error.  If it fails, the `skb`
is not saved in the rx ringbuffer and thus lost.

Compile tested only

Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250616105631.444309-4-fourier.thomas@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index 9339c6d2b2581167679900741fe8eb68e1da633d..daf6d0eeb3e3c5d9a1fba30374d350e4de3195fb 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -804,13 +804,19 @@ new_trx_end:
                skb = new_skb;
 no_new:
                if (rtlpriv->use_new_trx_flow) {
-                       _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
-                                                rxring_idx,
-                                                rtlpci->rx_ring[rxring_idx].idx);
+                       if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
+                                                     rxring_idx,
+                                                     rtlpci->rx_ring[rxring_idx].idx)) {
+                               if (new_skb)
+                                       dev_kfree_skb_any(skb);
+                       }
                } else {
-                       _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
-                                                rxring_idx,
-                                                rtlpci->rx_ring[rxring_idx].idx);
+                       if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
+                                                     rxring_idx,
+                                                     rtlpci->rx_ring[rxring_idx].idx)) {
+                               if (new_skb)
+                                       dev_kfree_skb_any(skb);
+                       }
                        if (rtlpci->rx_ring[rxring_idx].idx ==
                            rtlpci->rxringcount - 1)
                                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,