net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean

When the device is removed all allocated resources should be freed.
In uhdlc_memclean the netdev transmit queue was already stopped. But at
this point we may have pending skb in the transmit queue which must be
freed. Therefore iterate over the tx_skbuff pointers and free all
pending skb. The issue was discovered by sashiko.
Tested on a ls1043a board running HDLC in bus mode on kernel 6.12.

https: //sashiko.dev/#/patchset/20260429114208.941011-1-holger.brunck%40hitachienergy.com
Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC")
Signed-off-by: Holger Brunck <holger.brunck@hitachienergy.com>
Link: https://patch.msgid.link/20260507155332.3452319-1-holger.brunck@hitachienergy.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 15bfb78381d4cb749b4114558679fc5af86a34de..809f21fb93f56e33853e8ab3bfbe5c55c50f9313 100644 (file)
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -740,6 +740,8 @@ static int uhdlc_open(struct net_device *dev)
 
 static void uhdlc_memclean(struct ucc_hdlc_private *priv)
 {
+       int i;
+
        qe_muram_free(ioread16be(&priv->ucc_pram->riptr));
        qe_muram_free(ioread16be(&priv->ucc_pram->tiptr));
 
@@ -770,6 +772,11 @@ static void uhdlc_memclean(struct ucc_hdlc_private *priv)
        kfree(priv->rx_skbuff);
        priv->rx_skbuff = NULL;
 
+       for (i = 0; i < TX_BD_RING_LEN; i++) {
+               dev_kfree_skb(priv->tx_skbuff[i]);
+               priv->tx_skbuff[i] = NULL;
+       }
+
        kfree(priv->tx_skbuff);
        priv->tx_skbuff = NULL;