Commit 27f575836cfe for kernel

commit 27f575836cfebbf872dec020428742b10650a955
Author: Théo Lebrun <theo.lebrun@bootlin.com>
Date:   Thu Jul 2 17:37:02 2026 +0200

    net: macb: drop in-flight Tx SKBs on close

    The MACB driver has since forever leaked the outgoing SKBs that
    have not yet been marked as completed. They live in queue->tx_skb
    which gets freed without remorse nor checking.

    macb_free_consistent() gets called in a few codepaths, but only close will
    trigger the added expressions. In macb_open() and macb_alloc_consistent()
    failure cases, queues' tx_skb just got allocated and are empty.

    Fixes: 89e5785fc8a6 ("[PATCH] Atmel MACB ethernet driver")
    Cc: stable@vger.kernel.org
    Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
    Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
    Link: https://patch.msgid.link/20260702-macb-drop-tx-v4-1-1c833eebdbc8@bootlin.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index fd282a1700fb..d394f1f43b68 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -2668,8 +2668,25 @@ static void macb_free_consistent(struct macb *bp)
 	dma_free_coherent(dev, size, bp->queues[0].rx_ring, bp->queues[0].rx_ring_dma);

 	for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-		kfree(queue->tx_skb);
-		queue->tx_skb = NULL;
+		if (queue->tx_skb) {
+			unsigned int dropped = 0, tail;
+
+			for (tail = queue->tx_tail; tail != queue->tx_head;
+			     tail++) {
+				if (macb_tx_skb(queue, tail)->skb)
+					dropped++;
+				macb_tx_unmap(bp, macb_tx_skb(queue, tail), 0);
+			}
+
+			queue->stats.tx_dropped += dropped;
+			bp->dev->stats.tx_dropped += dropped;
+
+			kfree(queue->tx_skb);
+			queue->tx_skb = NULL;
+		}
+
+		queue->tx_head = 0;
+		queue->tx_tail = 0;
 		queue->tx_ring = NULL;
 		queue->rx_ring = NULL;
 	}