From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8314339EF16; Tue, 21 Jul 2026 15:50:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784649016; cv=none; b=GlFbQ1ML3DpN3f1PzhaB9TR9jrJfFNQVKDchHvWGBeNIIuhhL//IkMKkAxnB+6ttfQYAnDl9fRDZLtaFTdaUU5VZcxwPpyLGZ1pviO9zK75Dxs7stZ1N9JIYYfcngwS48cQzFt9fbsJqd5T9fRlfIsNcAOV8XQm3YFB1+0RkQIw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784649016; c=relaxed/simple; bh=I8f55mHhVjaBkZNw738BRoua93kggigRAqEOwvc075M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HuAJ/BdXhG8o5c/+Ln3bul3Z/8wPFQC9QrAOtfrnYzh1TUbaPdGTqqfDxfgtr1lijuP3NYaNW+EMwC/oS4HNYij9kHdQ6d0Zv+3TZJL/Yi1R6oDSGDwahiZDsOM1Iy2HMziCl49LHSfpQ+M8qiroHzY+W82ksyLWqSOhSiUy7k4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IPqci4uw; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="IPqci4uw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8E921F000E9; Tue, 21 Jul 2026 15:50:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784649015; bh=JBLS57bUj+dzGqIhOlJjm1Qg2c82PUJez22xUxG5xD0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IPqci4uwl2hzZQwY1LeiwEYKohzsRDq6Jv3BpjvEImHP6hyAxMAiSjvI6suO5F+XA +MKchFTvix91YGSmN1xqxPdrMneNGWj+YZk49pHEw+NzEdwqKFyDMif4nwIpMSeobw Xqd3NeKPnTiW6Bk9hn+yoys7US083cbhDSXQuoiY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Miaoqing Pan , Tamizh Chelvam Raja , Baochen Qiang , Jeff Johnson , Sasha Levin Subject: [PATCH 7.1 0419/2077] wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() Date: Tue, 21 Jul 2026 17:01:32 +0200 Message-ID: <20260721152602.620861554@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152552.646164743@linuxfoundation.org> References: <20260721152552.646164743@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Miaoqing Pan [ Upstream commit 98d4f92ab6a1af2ea2ab590d7e2801b203110981 ] In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the NWIFI header length is invalid, causing the function to abort early with -EINVAL. When this happens, the error propagates to ath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it to NULL. As a result, the corresponding MSDU is no longer referenced by the defragmentation path and is never freed. This leads to a memory leak for the affected MSDU on this error path. Proper cleanup is required to ensure the MSDU is released when header validation fails during TKIP MIC verification. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 9a0dddfb30f1 ("wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi") Signed-off-by: Miaoqing Pan Reviewed-by: Tamizh Chelvam Raja Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260512021108.2031651-1-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c index 945680b3ebdfce..a5e290edaa898c 100644 --- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c @@ -1028,8 +1028,10 @@ static int ath12k_wifi7_dp_rx_h_verify_tkip_mic(struct ath12k_pdev_dp *dp_pdev, skb_pull(msdu, hal_rx_desc_sz); if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(dp, msdu, - rx_info))) + rx_info))) { + dev_kfree_skb_any(msdu); return -EINVAL; + } ath12k_dp_rx_h_ppdu(dp_pdev, rx_info); ath12k_dp_rx_h_undecap(dp_pdev, msdu, HAL_ENCRYPT_TYPE_TKIP_MIC, true, -- 2.53.0