Re: [PATCH net] idpf: free the skb on TX DMA mapping errors

[Alexander Lobakin]

From: Mina Almasry <almasrymina@xxxxxxxxxx>
Date: Sat, 24 Oct 2026 03:04:01 +0000

> From: Naman Gulati <namangulati@xxxxxxxxxx>
> 
> When a DMA mapping fails in idpf_tx_splitq_map() or
> idpf_tx_singleq_map(), the unwind walks the buffers with
> libeth_tx_complete(). The first buffer is still typed LIBETH_SQE_FRAG
> (or LIBETH_SQE_EMPTY if the linear data mapping itself failed) at that
> point, so it is only unmapped and the skb is never freed. The callers
> return NETDEV_TX_OK and do not touch the skb either, so it leaks.
> 
> Free the skb at the end of the unwind.
> 
> Fixes: d9028db618a6 ("idpf: convert to libeth Tx buffer completion")
> Signed-off-by: Naman Gulati <namangulati@xxxxxxxxxx>
> Signed-off-by: Mina Almasry <almasrymina@xxxxxxxxxx>
> ---
>  drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | 2 ++
>  drivers/net/ethernet/intel/idpf/idpf_txrx.c         | 3 +++
>  2 files changed, 5 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
> index e3ddf18dcbf51..010903260ff6f 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
> @@ -228,6 +228,8 @@ static void idpf_tx_singleq_dma_map_error(struct idpf_tx_queue *txq,
>  
>  	/* Update tail in case netdev_xmit_more was previously true */
>  	idpf_tx_buf_hw_update(txq, idx, false);
> +
> +	dev_kfree_skb_any(skb);
>  }
>  
>  /**
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> index 885df6294ad94..a92e2457781e6 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> @@ -2606,6 +2606,7 @@ static void idpf_tx_splitq_pkt_err_unmap(struct idpf_tx_queue *txq,
>  	struct idpf_sw_queue *refillq = txq->refillq;
>  	struct libeth_sq_napi_stats ss = { };
>  	struct idpf_tx_buf *tx_buf = first;
> +	struct sk_buff *skb = first->skb;
>  	struct libeth_cq_pp cp = {
>  		.dev    = txq->dev,
>  		.ss     = &ss,
> @@ -2621,6 +2622,8 @@ static void idpf_tx_splitq_pkt_err_unmap(struct idpf_tx_queue *txq,
>  		libeth_tx_complete(tx_buf, &cp);
>  	}
>  
> +	dev_kfree_skb_any(skb);

libeth_tx_complete() frees the skb.
Before this loop, it's called on @first.

> +
>  	/* Update tail in case netdev_xmit_more was previously true. */
>  	idpf_tx_buf_hw_update(txq, params->prev_ntu, false);
>  
> 
> base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5

Thanks,
Olek