Re: [PATCH net] net: atl1c: free the RX buffer when the descriptor reports an error

[Federico Musto]

The leak was found by inspection, not by triggering it.

While reviewing a separate change in the same function - the oversized-RX
drop, which removes an skb_over_panic that I did hit on this hardware - the
review pointed at this branch: atl1c_clean_rfd() clears the skb pointer
without unmapping or freeing, so every frame carrying RRS_RX_ERR_SUM or
RRS_802_3_LEN_ERR leaks one skb and one DMA mapping.  I have not reproduced
the leak with an injected error stream, so the change is untested beyond
compiling and applying: it only moves the unmap/free that the good path
already performs to before the RFD is recycled.

Hardware the driver work is done on: MikroTik CCR2004-1G-2XS-PCIe (4x
AR8151) in a Proxmox VE 9.2 host, kernel 7.0.14, atl1c built out of tree
with DKMS.  On that box the hardware error counters do move
(rx_len_err/rx_crc_err) when the link partner sends frames the host MTU
cannot take, which is how this branch gets reached in practice; I did not
isolate the leak itself on it.

If there is a deterministic way to force error descriptors on this device -
a specific register write or a known-bad traffic pattern - I am happy to run
it and report what the counters and /proc/slabinfo do.

Federico