Re: [PATCH] net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit

[Petko Manolov]

On 26-04-21 19:10:25, Morduan Zang wrote:
> When rtl8150_start_xmit() fails to submit the tx URB, the URB is never
> handed to the USB core and write_bulk_callback() will not run.  The
> driver returns NETDEV_TX_OK, which tells the networking stack that the
> skb has been consumed, but nothing actually frees the skb on this
> error path:
> 
>   dev->tx_skb = skb;
>   ...
>   if ((res = usb_submit_urb(dev->tx_urb, GFP_ATOMIC))) {
>           ...
>           /* no kfree_skb here */
>   }
>   return NETDEV_TX_OK;
> 
> This leaks the skb on every submit failure and also leaves dev->tx_skb
> pointing at memory that the driver itself may later free, which is
> fragile.
> 
> Free the skb with dev_kfree_skb_any() in the error path and clear
> dev->tx_skb so no stale pointer is left behind.

Another approach would be to use skb_copy_from_linear_data() to a static buffer
and free the skb right away.  Take a look at pegasus_start_xmit() in
drivers/net/usb/pegasus.c.  This comes at the cost of yet another memcpy,
though.

The above is not to say i don't like your current approach, just FYI.


		Petko