[PATCH] net: cxgb4: do not leak a PTP skb when the Tx queue is busy

From: Wentao Liang

Date: Tue Nov 03 2026 - 05:28:44 EST


cxgb4_eth_xmit() stores the PTP skb in adap->ptp_tx_skb with an extra
reference before the descriptor credits are checked. When the PTP
queue is full the function returns NETDEV_TX_BUSY, and later failures
such as an unsupported FCoE offload or a failed DMA mapping jump to
out_free. None of those paths transmit the packet, so no transmit
timestamp ever arrives and the extra reference is never released.

Only take the extra reference once the packet is certain to be queued,
just before it is handed to the hardware. The initial check for an
outstanding PTP skb is kept, and PTP transmits are serialized by
adap->ptp_lock, so only one PTP packet can be in flight.

Fixes: a456950445a0 ("cxgb4: time stamping interface for PTP")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
drivers/net/ethernet/chelsio/cxgb4/sge.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 9fccb8ea9bcd..7e83f60bd14e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -1523,12 +1523,9 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev)

qidx = skb_get_queue_mapping(skb);
if (ptp_enabled) {
- if (!(adap->ptp_tx_skb)) {
- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
- adap->ptp_tx_skb = skb_get(skb);
- } else {
+ if (adap->ptp_tx_skb)
goto out_free;
- }
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
q = &adap->sge.ptptxq;
} else {
q = &adap->sge.ethtxq[qidx + pi->first_qset];
@@ -1707,6 +1704,9 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev)

skb_tx_timestamp(skb);

+ if (ptp_enabled)
+ adap->ptp_tx_skb = skb_get(skb);
+
if (immediate) {
cxgb4_inline_tx_skb(skb, &q->q, sgl);
dev_consume_skb_any(skb);
--
2.34.1