Re: [PATCH net v3] net: wwan: t7xx: check skb_clone in control TX

[Loic Poulain]

On Fri, Jun 12, 2026 at 5:56 AM Ruoyu Wang <ruoyuw560@xxxxxxxxx> wrote:
>
> t7xx_port_ctrl_tx() clones each skb fragment before passing it to the
> port transmit path. The clone is used immediately to set cloned->len, so
> an skb_clone() failure results in a NULL pointer dereference.
>
> Check the clone before using it. If previous fragments were already
> queued, preserve the driver's existing partial-write behavior by
> returning the number of bytes submitted so far.
>
> Fixes: 36bd28c1cb0d ("wwan: core: Support slicing in port TX flow of WWAN subsystem")
> Signed-off-by: Ruoyu Wang <ruoyuw560@xxxxxxxxx>

Reviewed-by: Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>

> ---
> Changes in v3:
> - Preserve the partial-write return value when skb_clone() fails after
>   earlier fragments were submitted.
>
> Changes in v2:
> - Add Fixes tag.
> - Return -ENOMEM consistently on skb_clone() failure.
>
>  drivers/net/wwan/t7xx/t7xx_port_wwan.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/wwan/t7xx/t7xx_port_wwan.c b/drivers/net/wwan/t7xx/t7xx_port_wwan.c
> index 7fc569565..d2529df75 100644
> --- a/drivers/net/wwan/t7xx/t7xx_port_wwan.c
> +++ b/drivers/net/wwan/t7xx/t7xx_port_wwan.c
> @@ -106,6 +106,8 @@ static int t7xx_port_ctrl_tx(struct t7xx_port *port, struct sk_buff *skb)
>
>         while (cur) {
>                 cloned = skb_clone(cur, GFP_KERNEL);
> +               if (!cloned)
> +                       return cnt ? cnt : -ENOMEM;
>                 cloned->len = skb_headlen(cur);
>                 ret = t7xx_port_send_skb(port, cloned, 0, 0);
>                 if (ret) {
> --
> 2.51.0
>