atl1c_clean_rx() drops a frame whose return descriptor carries RRS_RX_ERR_SUM or RRS_802_3_LEN_ERR by calling atl1c_clean_rfd(), which only marks the RFD free and clears the skb pointer. Nothing unmaps the DMA mapping and nothing frees the skb, so every errored frame - CRC, alignment, truncation, runt - leaks one skb and one DMA mapping. The driver uses a 32-bit DMA mask, so on a host without an IOMMU each of those mappings also pins a swiotlb slot. Unmap and free before the RFD is recycled, the same way the good path does. The hardware already counts these frames in its own error counters, which atl1c_get_stats() reports, so no software counter is added here. Fixes: 43250ddd75a3 ("atl1c: Atheros L1C Gigabit Ethernet driver") Cc: stable@vger.kernel.org Signed-off-by: Federico Musto --- Spotted while reviewing a fix for a different problem in the same function (skb_over_panic on oversized RX frames), by the Sashiko review bot. It is independent of that patch and applies on its own. The guard on buffer_info->skb is there because the slot can be empty after a reset; rfd_num != 1 stays on the old path, since multi-RFD is not supported by this driver anywhere else either. --- drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c index e58f1d2..2d68955 100644 --- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c @@ -1908,6 +1908,23 @@ static int atl1c_clean_rx(struct napi_struct *napi, int budget) rrs_checked: atl1c_clean_rrd(rrd_ring, rrs, rfd_num); if (rrs->word3 & (RRS_RX_ERR_SUM | RRS_802_3_LEN_ERR)) { + /* The RFD is recycled below, and that drops the only + * pointer to the buffer: unmap and free it first, or the + * skb and its DMA mapping leak on every errored frame. + */ + if (likely(rfd_num == 1)) { + rfd_index = (rrs->word0 >> RRS_RX_RFD_INDEX_SHIFT) & + RRS_RX_RFD_INDEX_MASK; + buffer_info = &rfd_ring->buffer_info[rfd_index]; + if (buffer_info->skb) { + dma_unmap_single(&pdev->dev, + buffer_info->dma, + buffer_info->length, + DMA_FROM_DEVICE); + kfree_skb_reason(buffer_info->skb, + SKB_DROP_REASON_NOT_SPECIFIED); + } + } atl1c_clean_rfd(rfd_ring, rrs, rfd_num); if (netif_msg_rx_err(adapter)) dev_warn(&pdev->dev, -- 2.54.0 (Apple Git-157)