[PATCH net v2] net: ethernet: mtk_eth_soc: fix memory leak in LRO rings release

[Daniel Golle]

On Mon, Aug 12, 2024 at 06:21:19PM +0300, Elad Yifee wrote:
> For LRO we allocate more than one page, yet 'skb_free_frag' is used
> to free the buffer, which only frees a single page.
> Fix it by using 'free_pages' instead.
> 
> Fixes: 2f2c0d2919a1 ("net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag")
> Signed-off-by: Elad Yifee <eladwf at gmail.com>
> ---
> v2: fixed compilation warnings
> ---
>  drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> index 16ca427cf4c3..e25b552d70f7 100644
> --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> @@ -1762,8 +1762,10 @@ static void mtk_rx_put_buff(struct mtk_rx_ring *ring, void *data, bool napi)
>  	if (ring->page_pool)
>  		page_pool_put_full_page(ring->page_pool,
>  					virt_to_head_page(data), napi);
> -	else
> +	else if (ring->frag_size <= PAGE_SIZE)
>  		skb_free_frag(data);
> +	else
> +		free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size)));
You miss on open '(' there. Won't even compile like that.
Please always compile- and run-time test patches before sending them
to the mailing list.

>  }
>  
>  static int mtk_xdp_frame_map(struct mtk_eth *eth, struct net_device *dev,
> @@ -2132,7 +2134,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
>  				ring->buf_size, DMA_FROM_DEVICE);
>  			if (unlikely(dma_mapping_error(eth->dma_dev,
>  						       dma_addr))) {
> -				skb_free_frag(new_data);
> +				mtk_rx_put_buff(ring, new_data, true);
>  				netdev->stats.rx_dropped++;
>  				goto release_desc;
>  			}
> @@ -2146,7 +2148,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
>  			skb = build_skb(data, ring->frag_size);
>  			if (unlikely(!skb)) {
>  				netdev->stats.rx_dropped++;
> -				skb_free_frag(data);
> +				mtk_rx_put_buff(ring, data, true);
>  				goto skip_rx;
>  			}
>  
> @@ -2691,7 +2693,7 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag)
>  				ring->buf_size, DMA_FROM_DEVICE);
>  			if (unlikely(dma_mapping_error(eth->dma_dev,
>  						       dma_addr))) {
> -				skb_free_frag(data);
> +				mtk_rx_put_buff(ring, data, false);
>  				return -ENOMEM;
>  			}
>  		}
> -- 
> 2.45.2
>