[PATCH net] idpf: free the skb on TX DMA mapping errors

[Mina Almasry <almasrymina@google.com>]

From: Naman Gulati <namangulati@google.com>

When a DMA mapping fails in idpf_tx_splitq_map() or
idpf_tx_singleq_map(), the unwind walks the buffers with
libeth_tx_complete(). The first buffer is still typed LIBETH_SQE_FRAG
(or LIBETH_SQE_EMPTY if the linear data mapping itself failed) at that
point, so it is only unmapped and the skb is never freed. The callers
return NETDEV_TX_OK and do not touch the skb either, so it leaks.

Free the skb at the end of the unwind.

Fixes: d9028db618a6 ("idpf: convert to libeth Tx buffer completion")
Signed-off-by: Naman Gulati <namangulati@google.com>
Signed-off-by: Mina Almasry <almasrymina@google.com>
---
 drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | 2 ++
 drivers/net/ethernet/intel/idpf/idpf_txrx.c         | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
index e3ddf18dcbf51..010903260ff6f 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
@@ -228,6 +228,8 @@ static void idpf_tx_singleq_dma_map_error(struct idpf_tx_queue *txq,
 
 	/* Update tail in case netdev_xmit_more was previously true */
 	idpf_tx_buf_hw_update(txq, idx, false);
+
+	dev_kfree_skb_any(skb);
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
index 885df6294ad94..a92e2457781e6 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -2606,6 +2606,7 @@ static void idpf_tx_splitq_pkt_err_unmap(struct idpf_tx_queue *txq,
 	struct idpf_sw_queue *refillq = txq->refillq;
 	struct libeth_sq_napi_stats ss = { };
 	struct idpf_tx_buf *tx_buf = first;
+	struct sk_buff *skb = first->skb;
 	struct libeth_cq_pp cp = {
 		.dev    = txq->dev,
 		.ss     = &ss,
@@ -2621,6 +2622,8 @@ static void idpf_tx_splitq_pkt_err_unmap(struct idpf_tx_queue *txq,
 		libeth_tx_complete(tx_buf, &cp);
 	}
 
+	dev_kfree_skb_any(skb);
+
 	/* Update tail in case netdev_xmit_more was previously true. */
 	idpf_tx_buf_hw_update(txq, params->prev_ntu, false);
 

base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
-- 
2.56.0.257.gf7497c7d27-goog