[PATCH v2] net: wwan: iosm: drop redundant skb->data check in MUX DL decode

[PATCH v2] net: wwan: iosm: drop redundant skb->data check in MUX DL decode

[Fang Xieyan]

The skb passed to ipc_mux_dl_decode() through the current RX path
always has a valid data pointer.

The only caller, ipc_imem_dl_skb_process(), checks for a NULL skb
before calling ipc_mux_dl_decode(). The skb is allocated through
ipc_pcie_alloc_skb() -> ipc_pcie_alloc_local_skb() ->
__netdev_alloc_skb(), which provides a valid data buffer on
successful allocation. Allocation or DMA mapping failures return
a NULL skb instead.

Remove the redundant skb->data check.

Suggested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
Changes in v2:
- Drop the "fix potential skb leak" approach. The skb->data NULL
  condition is unreachable through the current RX path, so remove
  the redundant check instead of adding an ipc_pcie_kfree_skb() call.
- Drop the Fixes: tag because this patch does not fix a reachable bug.

 drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
index 0bbd41263cc2..2b8a22980c87 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
@@ -693,9 +693,6 @@ void ipc_mux_dl_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb)
 {
 	u32 signature;
 
-	if (!skb->data)
-		return;
-
 	/* Decode the MUX header type. */
 	signature = le32_to_cpup((__le32 *)skb->data);
 
-- 
2.50.1

Re: [PATCH v2] net: wwan: iosm: drop redundant skb->data check in MUX DL decode

[Loic Poulain]

On Tue, Nov 3, 2026 at 3:59 PM Fang Xieyan <fangxy@xiaopeng.com> wrote:
>
> The skb passed to ipc_mux_dl_decode() through the current RX path
> always has a valid data pointer.
>
> The only caller, ipc_imem_dl_skb_process(), checks for a NULL skb
> before calling ipc_mux_dl_decode(). The skb is allocated through
> ipc_pcie_alloc_skb() -> ipc_pcie_alloc_local_skb() ->
> __netdev_alloc_skb(), which provides a valid data buffer on
> successful allocation. Allocation or DMA mapping failures return
> a NULL skb instead.
>
> Remove the redundant skb->data check.
>
> Suggested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>

On top of that, the early-return branch does not release the related resources.

Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>

> ---
> Changes in v2:
> - Drop the "fix potential skb leak" approach. The skb->data NULL
>   condition is unreachable through the current RX path, so remove
>   the redundant check instead of adding an ipc_pcie_kfree_skb() call.
> - Drop the Fixes: tag because this patch does not fix a reachable bug.
>
>  drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 3 ---
>  1 file changed, 3 deletions(-)
>
> diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
> index 0bbd41263cc2..2b8a22980c87 100644
> --- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
> +++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
> @@ -693,9 +693,6 @@ void ipc_mux_dl_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb)
>  {
>         u32 signature;
>
> -       if (!skb->data)
> -               return;
> -
>         /* Decode the MUX header type. */
>         signature = le32_to_cpup((__le32 *)skb->data);
>
> --
> 2.50.1
>

Re: [PATCH v2] net: wwan: iosm: drop redundant skb->data check in MUX DL decode

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Tue,  3 Nov 2026 22:59:25 +0800 you wrote:
> The skb passed to ipc_mux_dl_decode() through the current RX path
> always has a valid data pointer.
> 
> The only caller, ipc_imem_dl_skb_process(), checks for a NULL skb
> before calling ipc_mux_dl_decode(). The skb is allocated through
> ipc_pcie_alloc_skb() -> ipc_pcie_alloc_local_skb() ->
> __netdev_alloc_skb(), which provides a valid data buffer on
> successful allocation. Allocation or DMA mapping failures return
> a NULL skb instead.
> 
> [...]

Here is the summary with links:
  - [v2] net: wwan: iosm: drop redundant skb->data check in MUX DL decode
    https://git.kernel.org/netdev/net-next/c/66974df65a0b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

[PATCH] net: wwan: iosm: fix potential skb leak in MUX DL decode

[Fang Xieyan]

ipc_mux_dl_decode() owns the received skb and frees it after
decoding. However, the early return when skb->data is NULL
bypasses the skb cleanup.

Free the skb through ipc_pcie_kfree_skb() before returning
to ensure that both the DMA mapping and skb are released.

Fixes: 3670970dd8c6 ("net: iosm: shared memory IPC interface")
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
 drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
index 0bbd41263cc2..61700688eac9 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
@@ -693,8 +693,10 @@ void ipc_mux_dl_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb)
 {
 	u32 signature;
 
-	if (!skb->data)
+	if (!skb->data) {
+		ipc_pcie_kfree_skb(ipc_mux->pcie, skb);
 		return;
+	}
 
 	/* Decode the MUX header type. */
 	signature = le32_to_cpup((__le32 *)skb->data);
-- 
2.50.1

[PATCH v2] net: wwan: iosm: drop redundant skb->data check in MUX DL decode

[Fang Xieyan]

The skb passed to ipc_mux_dl_decode() through the current RX path
always has a valid data pointer.

The only caller, ipc_imem_dl_skb_process(), checks for a NULL skb
before calling ipc_mux_dl_decode(). The skb is allocated through
ipc_pcie_alloc_skb() -> ipc_pcie_alloc_local_skb() ->
__netdev_alloc_skb(), which provides a valid data buffer on
successful allocation. Allocation or DMA mapping failures return
a NULL skb instead.

Remove the redundant skb->data check.

Suggested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
Changes in v2:
- Drop the "fix potential skb leak" approach. The skb->data NULL
  condition is unreachable through the current RX path, so remove
  the redundant check instead of adding an ipc_pcie_kfree_skb() call.
- Drop the Fixes: tag because this patch does not fix a reachable bug.

 drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
index 0bbd41263cc2..2b8a22980c87 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
@@ -693,9 +693,6 @@ void ipc_mux_dl_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb)
 {
 	u32 signature;
 
-	if (!skb->data)
-		return;
-
 	/* Decode the MUX header type. */
 	signature = le32_to_cpup((__le32 *)skb->data);
 
-- 
2.50.1

Re: [PATCH v2] net: wwan: iosm: drop redundant skb->data check in MUX DL decode

[Andrew Lunn]

On Tue, Nov 03, 2026 at 07:11:01PM +0800, Fang Xieyan wrote:
> The skb passed to ipc_mux_dl_decode() through the current RX path
> always has a valid data pointer.
> 
> The only caller, ipc_imem_dl_skb_process(), checks for a NULL skb
> before calling ipc_mux_dl_decode(). The skb is allocated through
> ipc_pcie_alloc_skb() -> ipc_pcie_alloc_local_skb() ->
> __netdev_alloc_skb(), which provides a valid data buffer on
> successful allocation. Allocation or DMA mapping failures return
> a NULL skb instead.
> 
> Remove the redundant skb->data check.
> 
> Suggested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
> ---
> Changes in v2:

Please always start a new thread for a new version of the patch. The
CI system does not always pick up the patch and run it.

Please also read:

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html


    Andrew

---
pw-bot: cr