Re: [PATCH net] net: hip04: fix RX buffer leak on build_skb failure

[Jacob Keller]

On 7/15/2026 12:30 AM, Fan Wu wrote:
> Hi Jacob,
> 
> Thanks for the review. I agree this is a rare allocation-failure path.
> 
> The leak is nevertheless deterministic from the ownership contract and
> the driver's control flow. __build_skb() documents that, on failure, it
> returns NULL without freeing the caller-provided data.
> 
> hip04_rx_poll() currently jumps to refill before dma_unmap_single().
> Refill then replaces rx_buf[rx_head] and rx_phys[rx_head], so the old
> fragment and its streaming DMA mapping are no longer reachable. The
> stop and free-ring paths only operate on entries still referenced by
> those arrays.
> 
> The fix leaves the slot, descriptor, rx_head, and rx_cnt_remaining
> unchanged, and returns budget. This tells NAPI that RX work remains
> outstanding and retries build_skb() using the same buffer. The additional
> skb_free_frag() handles the separate case where a replacement fragment
> was allocated but dma_map_single() failed before it was installed.
> 
> I hope this clarifies why the failure path is a deterministic leak even
> though I do not have a dynamic reproduction on HIP04 hardware.
> 

Thanks,
Jake

> Thanks,
> Fan
>