From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f169.google.com (mail-oi1-f169.google.com [209.85.167.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BAAB843C7AC for ; Wed, 15 Jul 2026 10:34:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784111695; cv=none; b=O0iuscIaEBJcuWY/sASKgoyCa2UUsxS48ixUV08GIJck1sUnzk5qHFjTWIjcsiq25Q3Hj861Skxv6qunY+AFGLlGkC21bawPzwzN9q5+AxVZpJY+MeZ5Fn0rAMbbZlpGauCcSlRYPZQmxcGC8tOWROXYnOyjViTzQL60D7VjXIo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784111695; c=relaxed/simple; bh=HCd3dYdTzeSr0/x7Y7nuHdop6BQWGYF6ITMoFKwUxVE=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ep3YtWUhd6SWispVS/V4z9zCI1nb7uu5R1ybroQ2L+ZdGnMGYjDFmdT1sMlGQ8C6ZFN8/ndW2JpqbAH9LlVyrcXD0ZxIAS0TSLpPMGOWCnq31hL69afD1TtQnmXdYpexbipSHE9dOfTCd3Hs3yafRS4l0WUNzfR18iNVnFHAsUw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AhSgw1An; arc=none smtp.client-ip=209.85.167.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AhSgw1An" Received: by mail-oi1-f169.google.com with SMTP id 5614622812f47-495c63c41ceso2716886b6e.2 for ; Wed, 15 Jul 2026 03:34:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784111692; x=1784716492; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Ixbs4H/5miSkvcWWnp1MjSu7kVoZLo9FSG6aq3RRnsI=; b=AhSgw1AnVkguTIuLIZ5jp971fvBsEnz+3rdv4qts6G/XYmeG80eV6QGislbfyuT/SS xiSZUmqPJB2TTYUmgQ7E3BJA2d0d0h90mXGkeOXQBNeO47s+qDL22bEtSy/UG0ybtBp/ sUIyfCaP0hSaJwKRFODhZGVJ+pIEiZLDamacwrm1rPAjtIr2yqDTcf6zn+QHLoaIY6yF SWY59oLR8TBB+pYBkgdXnReCuTxZmf36P05ewxyemApAymcgwCz4fAh1IJxekfqmRgVe D2RQiLwWCniupN97j+zUtsSGIT0DZqr3KRg5RvR1au0xMVG+1lnKUA8M0i1BMYPYHN+O vTeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784111692; x=1784716492; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Ixbs4H/5miSkvcWWnp1MjSu7kVoZLo9FSG6aq3RRnsI=; b=J7ep+Q3E/wrMAVrhVzg6WFTp5i0CNC4pidhdxmlP3IWj6BuByj37BQ9ZzxdP0ph9hJ InNcp2V4W+ZvlBxXFqhKpFiDmBXOKja9ji9AWPkM2npKscaljWI5LzddA8S9sbnDtz1n 2jmvQ0y8l+7Q0bW2PjOkqFyldSJ4PYT6zWdsFG963aU9hRGby/9TH9V3vTM67fd/OXwh VUV9NGOuDxdDmvWabBZPFsuKfXlXK39iD9jmo2buzzcXLFHvQ2RhqcAeBjwCBELwMtAr 7tgoK7MhSs2L5gtElOWYiI+nY6YpcsVMLHa+MevrQ2gZ1hpv4n41yuL8lMcPRE2VmMy6 vnmg== X-Forwarded-Encrypted: i=1; AHgh+RoOzGm96lr4VU/w6ZoAYTP1rHjmRsHwSi4pOKjBbvsUUv8vqjPqTxb7Rjsgbr5pob4RKuBZmt/VP6UmCjU=@vger.kernel.org X-Gm-Message-State: AOJu0Yxkl89Cud16u2f02g1Qv0a2gizWNK6QBZum7vjDHfh/EafuPgZf GGvhD3H7UM1BCaCzFKjVZS+AKG2JiH1S2w/k/CArDJ4bOz1mYhUYrp7U X-Gm-Gg: AfdE7cmVuXFEB61bJzpKZWxYjUXPW2AAKRGIvSfGF5uTzA0OIZM/m4pT66nnGKFp7VH NAMe57Rq4RM8Ipjw4mpN79oSnIFSt+9kRuBC97XE32mCqivc06yu4gRvmUlm+z3msZAxs97Zr0a bnclppfv+7Uj2KTwlidlkAmcZl0hiOlBKb/krkQ0zayQLxlk7z4SFKrVaKEUk1B6wkGU4XOMBtl aoEutMi7jSTz9rMr+vWN41XP8ajELLv3X1SR8u/jPhAsIeSCjFY/Uw4/Q2Fr+aTNn1+NZKN8yv8 K+oovJUekD0XhIdU6oX7/GARwQBH3KLnD4MpDbHfMKaYGNeSu04vdVEqSD0/B2jlCRETwdq4Yar gsrs/sEAgSajQUtwhWvVb1E5vMdtI1qjHDr31ZYjR3KwkZYmDN9fNz+9NzvssviiCrzqfh6PTT/ 3gybzU X-Received: by 2002:a05:6808:190a:b0:49b:dcb8:e2ce with SMTP id 5614622812f47-4a4961a042amr1770737b6e.39.1784111692466; Wed, 15 Jul 2026 03:34:52 -0700 (PDT) Received: from localhost ([74.80.182.90]) by smtp.gmail.com with ESMTPSA id 5614622812f47-4a1ad5a77e3sm15714428b6e.6.2026.07.15.03.34.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 03:34:50 -0700 (PDT) Date: Wed, 15 Jul 2026 13:34:44 +0300 From: Dan Carpenter To: Cong Nguyen Cc: Greg Kroah-Hartman , linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [PATCH] staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths Message-ID: References: <20260714163525.175763-1-congnt264@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260714163525.175763-1-congnt264@gmail.com> On Tue, Jul 14, 2026 at 11:35:25PM +0700, Cong Nguyen wrote: > issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management > xmit_frame together with its xmit_buf from the driver's fixed-size > management-TX pools via alloc_mgtxmitframe(). On the normal path the frame > is handed to dump_mgntframe(), which transfers ownership and eventually > returns both objects to their pools (the frame and, for beacons, the buf > in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion > path). > > Several error/edge paths return early after a successful > alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never > transferred and neither object is freed: > > - issue_beacon(): beacon larger than 512 bytes > - issue_probersp(): cur_network->ie_length > MAX_IE_SZ > - issue_probersp(): kzalloc() of the SSID scratch buffer fails > - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP > > Because alloc_mgtxmitframe() removes the frame and buf from their free > lists (list_del_init) without placing them on any pending list, an > orphaned pair is on no list and referenced by nobody, so it is only > reclaimed at driver teardown. Repeated hits progressively exhaust the > management-TX pools until alloc_mgtxmitframe() returns NULL and the > interface can no longer send beacons or probe/assoc responses. > > Free the frame and buffer on these paths, matching the existing correct > error handling in issue_assocreq(). > > Signed-off-by: Cong Nguyen > --- Looks reasonable. Please add a Fixes tag. Reviewed-by: Dan Carpenter regards, dan carpenter