[PATCH 02/16] NTB: ntb_transport: Reject oversized TX buffers

[Koichiro Den]

ntb_process_tx() handles an oversized buffer by calling tx_handler()
with a NULL data pointer, returning the queue entry to tx_free_q, and
returning success. ntb_netdev therefore neither frees the skb from the
callback nor takes its enqueue error path, leaking it.

Return -EMSGSIZE instead. ntb_transport_tx_enqueue() puts the acquired
queue entry back on tx_free_q when ntb_process_tx() fails, while the
caller retains ownership of the rejected buffer.

Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
Signed-off-by: Koichiro Den <den@xxxxxxxxxxxxx>
---
 drivers/ntb/ntb_transport.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 3efc50955253..3a9635faad9e 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1962,14 +1962,8 @@ static int ntb_process_tx(struct ntb_transport_qp *qp,
 		return -EAGAIN;
 	}
 
-	if (entry->len > qp->tx_max_frame - sizeof(struct ntb_payload_header)) {
-		if (qp->tx_handler)
-			qp->tx_handler(qp, qp->cb_data, NULL, -EIO);
-
-		ntb_list_add(&qp->ntb_tx_free_q_lock, &entry->entry,
-			     &qp->tx_free_q);
-		return 0;
-	}
+	if (entry->len > qp->tx_max_frame - sizeof(struct ntb_payload_header))
+		return -EMSGSIZE;
 
 	ntb_async_tx(qp, entry);
 
-- 
2.51.0