Re: [PATCH net] net: hip04: fix RX buffer leak on build_skb failure

[Fan Wu]

Hi Jacob,

Thanks for the review. I agree this is a rare allocation-failure path.

The leak is nevertheless deterministic from the ownership contract and
the driver's control flow. __build_skb() documents that, on failure, it
returns NULL without freeing the caller-provided data.

hip04_rx_poll() currently jumps to refill before dma_unmap_single().
Refill then replaces rx_buf[rx_head] and rx_phys[rx_head], so the old
fragment and its streaming DMA mapping are no longer reachable. The
stop and free-ring paths only operate on entries still referenced by
those arrays.

The fix leaves the slot, descriptor, rx_head, and rx_cnt_remaining
unchanged, and returns budget. This tells NAPI that RX work remains
outstanding and retries build_skb() using the same buffer. The additional
skb_free_frag() handles the separate case where a replacement fragment
was allocated but dma_map_single() failed before it was installed.

I hope this clarifies why the failure path is a deterministic leak even
though I do not have a dynamic reproduction on HIP04 hardware.

Thanks,
Fan