ice_clean_rx_irq_zc() consumes a descriptor without freeing its buffer when a frag has zero length or when xsk_buff_add_frag() fails, which happens if the frags array is full or the fill ring has duplicates. Such buffers are lost to user space until the socket is closed. Free the buffer in both cases. xp_free() skips a duplicate already freed with the frame. Fixes: 1bbc04de607b ("ice: xsk: add RX multi-buffer support") Fixes: 93f53db9f9dc ("ice: switch to Page Pool") Signed-off-by: Maciej Fijalkowski --- drivers/net/ethernet/intel/ice/ice_xsk.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c index 0643017541c3..ea8ac0fcdf6e 100644 --- a/drivers/net/ethernet/intel/ice/ice_xsk.c +++ b/drivers/net/ethernet/intel/ice/ice_xsk.c @@ -618,8 +618,11 @@ int ice_clean_rx_irq_zc(struct ice_rx_ring *rx_ring, if (!first) { first = xdp; - } else if (likely(size) && !xsk_buff_add_frag(first, xdp)) { + } else if (unlikely(!size)) { + xsk_buff_free(xdp); + } else if (!xsk_buff_add_frag(first, xdp)) { xsk_buff_free(first); + xsk_buff_free(xdp); first = NULL; } -- 2.43.0