net: macb: drop in-flight Tx SKBs on close
authorThéo Lebrun <theo.lebrun@bootlin.com>
Thu, 2 Jul 2026 15:37:02 +0000 (17:37 +0200)
committerPaolo Abeni <pabeni@redhat.com>
Thu, 9 Jul 2026 08:48:15 +0000 (10:48 +0200)
commit27f575836cfebbf872dec020428742b10650a955
treeca480038eecbd50ba8886cc7f2591b7f2bc43d59
parentc26c33e632248b334ccf132bc8c4877522c3db95
net: macb: drop in-flight Tx SKBs on close

The MACB driver has since forever leaked the outgoing SKBs that
have not yet been marked as completed. They live in queue->tx_skb
which gets freed without remorse nor checking.

macb_free_consistent() gets called in a few codepaths, but only close will
trigger the added expressions. In macb_open() and macb_alloc_consistent()
failure cases, queues' tx_skb just got allocated and are empty.

Fixes: 89e5785fc8a6 ("[PATCH] Atmel MACB ethernet driver")
Cc: stable@vger.kernel.org
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://patch.msgid.link/20260702-macb-drop-tx-v4-1-1c833eebdbc8@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
drivers/net/ethernet/cadence/macb_main.c