From: Dan Carpenter <error27@gmail.com>
To: Yuho Choi <dbgh9129@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-staging@lists.linux.dev, Hans de Goede <hansg@kernel.org>,
Michael Straube <straube.linux@gmail.com>,
Andy Shevchenko <andriy.shevchenko@intel.com>,
Minu Jin <s9430939@naver.com>,
Omer El Idrissi <omer.e.idrissi@gmail.com>,
William Hansen-Baird <william.hansen.baird@gmail.com>,
Ethan Tidmore <ethantidmore06@gmail.com>,
Ingo Molnar <mingo@kernel.org>,
linux-kernel@vger.kernel.org, Myeonghun Pak <mhun512@gmail.com>,
Ijae Kim <ae878000@gmail.com>, Taegyu Kim <tmk5904@psu.edu>
Subject: Re: [PATCH v1] staging: rtl8723bs: fix stale recv_frame free in recv_func_posthandle()
Date: Mon, 20 Apr 2026 17:20:24 +0300 [thread overview]
Message-ID: <aeY2KNbFP6rCQnd6@stanley.mountain> (raw)
In-Reply-To: <20260420042734.3685-1-dbgh9129@gmail.com>
On Mon, Apr 20, 2026 at 12:27:34AM -0400, Yuho Choi wrote:
> recv_func_posthandle() saved the original recv_frame pointer before
> calling recvframe_chk_defrag().
>
> On the last-fragment reassembly path, recvframe_chk_defrag() may return
> the first fragment as the new frame while freeing the original
> last-fragment frame when draining the defrag queue.
>
> If process_recv_indicatepkts() then fails, recv_func_posthandle() frees
> the saved pre-defrag pointer again, which can result in a stale pointer
> free.
You seem to be saying that process_recv_indicatepkts() frees
orig_prframe. And, sure, that's true. But then it returns NULL and we
goto _recv_data_drop so we don't hit this path.
This seems like a false positive.
regards,
dan carpenter
>
> Free the current recv_frame on the failure path instead of the saved
> pre-defrag pointer.
>
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
prev parent reply other threads:[~2026-04-20 14:20 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-20 4:27 [PATCH v1] staging: rtl8723bs: fix stale recv_frame free in recv_func_posthandle() Yuho Choi
2026-04-20 8:27 ` Andy Shevchenko
2026-04-20 10:05 ` Greg Kroah-Hartman
2026-04-20 14:20 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aeY2KNbFP6rCQnd6@stanley.mountain \
--to=error27@gmail.com \
--cc=ae878000@gmail.com \
--cc=andriy.shevchenko@intel.com \
--cc=dbgh9129@gmail.com \
--cc=ethantidmore06@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=hansg@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=mhun512@gmail.com \
--cc=mingo@kernel.org \
--cc=omer.e.idrissi@gmail.com \
--cc=s9430939@naver.com \
--cc=straube.linux@gmail.com \
--cc=tmk5904@psu.edu \
--cc=william.hansen.baird@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.