Commit eef7ab13 authored by Wang Hai's avatar Wang Hai Committed by Dong Chenchen
Browse files

be2net: fix potential memory leak in be_xmit() 

stable inclusion
from stable-v4.19.323
commit 941026023c256939943a47d1c66671526befbb26
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2STK
CVE: CVE-2024-50167

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=941026023c256939943a47d1c66671526befbb26



--------------------------------

[ Upstream commit e4dd8bfe0f6a23acd305f9b892c00899089bd621 ]

The be_xmit() returns NETDEV_TX_OK without freeing skb
in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it.

Fixes: 760c295e ("be2net: Support for OS2BMC.")
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Reviewed-by: default avatarKalesh AP <kalesh-anakkur.purayil@broadcom.com>
Message-ID: <20241015144802.12150-1-wanghai38@huawei.com>
Signed-off-by: default avatarAndrew Lunn <andrew@lunn.ch>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
parent faa52e40

drivers/net/ethernet/emulex/benet/be_main.c

+5 −5
Original line number Diff line number Diff line
@@ -1385,10 +1385,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) 
	be_get_wrb_params_from_skb(adapter, skb, &wrb_params);



	wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);

	if (unlikely(!wrb_cnt)) {

		dev_kfree_skb_any(skb);

		goto drop;

	}

	if (unlikely(!wrb_cnt))

		goto drop_skb;



	/* if os2bmc is enabled and if the pkt is destined to bmc,

	 * enqueue the pkt a 2nd time with mgmt bit set.
@@ -1397,7 +1395,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) 
		BE_WRB_F_SET(wrb_params.features, OS2BMC, 1);

		wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);

		if (unlikely(!wrb_cnt))

			goto drop;

			goto drop_skb;

		else

			skb_get(skb);

	}
@@ -1411,6 +1409,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) 
		be_xmit_flush(adapter, txo);



	return NETDEV_TX_OK;

drop_skb:

	dev_kfree_skb_any(skb);

drop:

	tx_stats(txo)->tx_drv_drops++;

	/* Flush the already enqueued tx requests */