When igc_fpe_init_tx_descriptor() fails, no one takes care of an allocated skb, leaking it. [1] Use dev_kfree_skb_any() on failure. Also call igc_flush_tx_descriptors() only on success. [1] unreferenced object 0xffff88813aee1b40 (size 224): comm "softirq", pid 0, jiffies 4294709256 [...] backtrace (crc dee31384): kmem_cache_alloc_node_noprof+0x54f/0x640 __alloc_skb+0xd9/0x5b0 igc_fpe_xmit_smd_frame.isra.0+0xad/0x510 igc_fpe_send_mpacket+0x32/0x80 [...] Fixes: 5422570c0010 ("igc: add support for frame preemption verification") Signed-off-by: Kohei Enju --- drivers/net/ethernet/intel/igc/igc_tsn.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c index 8a110145bfee..eaa274248d54 100644 --- a/drivers/net/ethernet/intel/igc/igc_tsn.c +++ b/drivers/net/ethernet/intel/igc/igc_tsn.c @@ -109,10 +109,14 @@ static int igc_fpe_xmit_smd_frame(struct igc_adapter *adapter, __netif_tx_lock(nq, cpu); err = igc_fpe_init_tx_descriptor(ring, skb, type); - igc_flush_tx_descriptors(ring); + if (!err) + igc_flush_tx_descriptors(ring); __netif_tx_unlock(nq); + if (err) + dev_kfree_skb_any(skb); + return err; } -- 2.51.0