Re: [PATCH net v1 0/3] net: fix stale TX skb pointers on DMA map failure

[Simon Horman]

On Fri, Jul 10, 2026 at 05:05:21PM +0800, xuanqiang.luo@xxxxxxxxx wrote:
> From: Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>
> 
> While I was backporting commit 1a303baa715e6 ("ice: fix double-free of
> tx_buf skb"), an AI-assisted scan identified several suspected TX error
> paths. I reviewed the results and found this issue in the three drivers
> fixed here.
> 
> The drivers differ, but the bug is the same. On a DMA mapping failure, the
> TX path frees an skb while its ring entry still points to it. A later
> transmission normally overwrites the entry. If the interface is stopped
> first, teardown can instead access or free the skb again.
> 
> I do not have these adapters, so I have not tested the drivers on hardware.
> I checked the error and teardown paths by inspection. Still, these small
> fixes seem worth posting for review. They are independent, but are sent as
> one series because they address the same issue.
> 
> Xuanqiang Luo (3):
>   bna: fix use-after-free on DMA mapping failure
>   hinic3: fix use-after-free on DMA mapping failure
>   net: hibmcge: fix double-free of tx skb on DMA mapping failure

For the series:

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>