When PTP is enabled, cxgb4_eth_xmit() takes an extra reference on the skb and stores it in adap->ptp_tx_skb. If the Tx queue is full the function returns NETDEV_TX_BUSY, and the remaining error paths jump to out_free; neither path releases that extra reference, so the skb is leaked and adap->ptp_tx_skb keeps a stale pointer. Move the adapter lookup before the first error path so out_free can use it, then release adap->ptp_tx_skb on both paths. Fixes: a456950445a0 ("cxgb4: time stamping interface for PTP") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/net/ethernet/chelsio/cxgb4/sge.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c index 9fccb8ea9bcd..5d4c63d9a937 100644 --- a/drivers/net/ethernet/chelsio/cxgb4/sge.c +++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c @@ -1503,12 +1503,13 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev) unsigned int chip_ver; struct adapter *adap; + pi = netdev_priv(dev); + adap = pi->adapter; + ret = cxgb4_validate_skb(skb, dev, ETH_HLEN); if (ret) goto out_free; - pi = netdev_priv(dev); - adap = pi->adapter; ssi = skb_shinfo(skb); #if IS_ENABLED(CONFIG_CHELSIO_IPSEC_INLINE) if (xfrm_offload(skb) && !ssi->gso_size) @@ -1553,6 +1554,10 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev) dev_err(adap->pdev_dev, "%s: Tx ring %u full while queue awake!\n", dev->name, qidx); + if (adap->ptp_tx_skb == skb) { + dev_kfree_skb_any(adap->ptp_tx_skb); + adap->ptp_tx_skb = NULL; + } return NETDEV_TX_BUSY; } @@ -1723,6 +1728,10 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev) return NETDEV_TX_OK; out_free: + if (adap->ptp_tx_skb == skb) { + dev_kfree_skb_any(adap->ptp_tx_skb); + adap->ptp_tx_skb = NULL; + } dev_kfree_skb_any(skb); return NETDEV_TX_OK; } -- 2.34.1