diff options
| author | Abdun Nihaal <nihaal@cse.iitm.ac.in> | 2026-07-27 12:12:22 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:22:58 +0200 |
| commit | 7364713f0931ee45fdf0bea27103b40ccc94979a (patch) | |
| tree | d952d51672b4bd88134eae15f631f463fa04fe97 | |
| parent | dc8b0be0ec4d9b0c80f07b27e656e4a94de5a344 (diff) | |
| download | linux-7364713f0931ee45fdf0bea27103b40ccc94979a.tar.gz linux-7364713f0931ee45fdf0bea27103b40ccc94979a.zip | |
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
commit 9f2948010764d708bda27369d09ce6f194abe8e3 upstream.
The skb passed to the rtw_hci_tx_write() is expected to be freed when
the function fails, but the error path in rtw_txq_push_skb() does not
free the skb before returning. This can lead to a memory leak in
rtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb().
Fixes: aaab5d0e6737 ("rtw88: kick off TX packets once for higher efficiency")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260727064223.61836-1-nihaal@cse.iitm.ac.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/wireless/realtek/rtw88/tx.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/realtek/rtw88/tx.c b/drivers/net/wireless/realtek/rtw88/tx.c index 9e24741b2cb1..611dade1b1eb 100644 --- a/drivers/net/wireless/realtek/rtw88/tx.c +++ b/drivers/net/wireless/realtek/rtw88/tx.c @@ -619,6 +619,7 @@ static int rtw_txq_push_skb(struct rtw_dev *rtwdev, ret = rtw_hci_tx_write(rtwdev, &pkt_info, skb); if (ret) { rtw_err(rtwdev, "failed to write TX skb to HCI\n"); + ieee80211_free_txskb(rtwdev->hw, skb); return ret; } return 0; |