[PATCH] net: cxgb: Fix skb reference leak in espibug_workaround_t204()

[Wentao Liang]

The timer handler takes an extra reference with skb_get() before handing
the skb to t1_sge_tx(), so that the skb survives until the DMA has
completed. When the command queue is full, t1_sge_tx() returns
NETDEV_TX_BUSY without queueing the skb, and the return value is
ignored, so the extra reference is never dropped.

Free the skb when t1_sge_tx() reports that it did not consume it.

Fixes: f1d3d38af757 ("[PATCH] chelsio: add support for other 10G boards")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/net/ethernet/chelsio/cxgb/sge.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb/sge.c b/drivers/net/ethernet/chelsio/cxgb/sge.c
index d8fca697874a..d4677c5b8d74 100644
--- a/drivers/net/ethernet/chelsio/cxgb/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb/sge.c
@@ -2052,7 +2052,8 @@ static void espibug_workaround_t204(struct timer_list *t)
 			 * the skb once the DMA has completed.
 			 */
 			skb = skb_get(skb);
-			t1_sge_tx(skb, adapter, 0, adapter->port[i].dev);
+			if (t1_sge_tx(skb, adapter, 0, adapter->port[i].dev))
+				dev_kfree_skb_any(skb);
 		}
 	}
 	mod_timer(&sge->espibug_timer, jiffies + sge->espibug_timeout);
-- 
2.34.1