Re: [PATCH] net: wwan: iosm: fix potential skb leak in MUX DL decode

[Fang Xieyan <fangxy@xiaopeng.com>]

Hi Loic,

You're right, skb->data cannot be NULL in this path. I traced both the
allocation side and the RX path that feeds ipc_mux_dl_decode(), and the
check can never trigger.

Allocation chain:

  ipc_pcie_alloc_skb()
    +-- ipc_pcie_alloc_local_skb()
          +-- __netdev_alloc_skb()

On success skb->data points into a valid linear buffer; skb_reserve()
only advances skb->data within that buffer and never clears the
pointer. Allocation or DMA mapping failure returns a NULL skb.

The RX path is:

  ipc_imem_dl_pipe_process()
    +-- ipc_protocol_dl_td_process()
    +-- ipc_imem_dl_skb_process()
          +-- if (!skb) return;
          +-- ipc_mux_dl_decode()

The skb is allocated and queued on the DL pipe by
ipc_protocol_dl_td_prepare(). It stores the skb in skbr_start[] only
after a successful allocation; on failure it returns without advancing
the head or publishing the descriptor.

On the RX path, ipc_protocol_dl_td_process() either returns a valid skb
or frees it and returns NULL. ipc_imem_dl_skb_process() checks for NULL
before calling ipc_mux_dl_decode().

The later skb_put() only updates skb->len and the tail; it does not
touch skb->data. DMA writes to the mapped data buffer, not to the skb
metadata.

I couldn't find any code in the IOSM driver that assigns skb->data to
NULL either.

So the check is unreachable: the skb that reaches ipc_mux_dl_decode()
always has a valid data pointer. I'll send a cleanup patch that removes
the redundant check instead.

Thanks.

Fang Xieyan