linux/drivers/net/ethernet/realtek
Yun Lu 6fb7b769d6 rtase: fix double free of multi-frag skb on DMA map failure
In rtase_start_xmit(), when the head buffer DMA mapping fails after
rtase_xmit_frags() has mapped all fragments, the error path clears
the fragment descriptors with rtase_tx_clear_range(), which frees
the skb through the last-frag slot and accounts tx_dropped. Control
then falls through to the common error label, which frees the same
skb a second time and counts it again.

Return right after clearing the fragments when the skb owns frags;
the no-frag case still drops through and frees the head skb once.

Fixes: d6e882b89f ("rtase: Implement .ndo_start_xmit function")
Signed-off-by: Yun Lu <luyun@kylinos.cn>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Justin Lai <justinlai0215@realtek.com>
Link: https://patch.msgid.link/20260721023836.6691-1-luyun_611@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27 18:16:42 -07:00
..
rtase rtase: fix double free of multi-frag skb on DMA map failure 2026-07-27 18:16:42 -07:00
8139cp.c net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
8139too.c net: Consistently define pci_device_ids using named initializers 2026-05-12 18:16:34 -07:00
Kconfig net: atp: drop ancient parallel-port Ethernet driver 2026-01-22 13:32:53 +01:00
Makefile net: atp: drop ancient parallel-port Ethernet driver 2026-01-22 13:32:53 +01:00
r8169_firmware.c r8169: remove optional size argument in calls to strscpy 2026-01-26 19:31:11 -08:00
r8169_firmware.h
r8169_leds.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
r8169_main.c net: Consistently define pci_device_ids using named initializers 2026-05-12 18:16:34 -07:00
r8169_phy_config.c r8169: add support for RTL8125cp 2026-03-05 13:41:48 +01:00
r8169.h r8169: add support for RTL8125cp 2026-03-05 13:41:48 +01:00