[PATCH] wifi: libipw: Do not return NETDEV_TX_BUSY after consuming the skb

[PATCH] wifi: libipw: Do not return NETDEV_TX_BUSY after consuming the skb

[Yuqiang Sun]

When the TKIP MSDU encryption is done in software (host_encrypt_msdu,
set by ipw2200), libipw_xmit() copies the frame into a new skb, frees
the original skb and goes on with the new one. If libipw_alloc_txb()
then fails, the function jumps to "failed" and returns NETDEV_TX_BUSY.
The core stack takes NETDEV_TX_BUSY as "skb not consumed" and requeues
the original skb, which has already been freed, so it is used after
free. The new skb is leaked.

Even without the swap, returning NETDEV_TX_BUSY from "failed" is wrong:
every jump there comes after skb_pull() removed the Ethernet header, so
a requeued skb is sent again without it.

Drop the frame on these errors instead: free the skb and return
NETDEV_TX_OK. Do not stop the queue either, since no frame is waiting
for it to be woken.

Fixes: 1264fc0498e1 ("[PATCH] ieee80211: Fix TKIP, repeated fragmentation problem, and payload_size reporting")
Cc: stable@vger.kernel.org
Signed-off-by: Yuqiang Sun <izaiahsun@gmail.com>
---

Notes:
    The bug was found with kbound, a research static analysis prototype.
    The patch and the changelog were written with the help of an AI coding
    assistant (Claude); I have reviewed them.
    
    Compile-tested only (x86_64 and arm64 allmodconfig, W=1, sparse): I do
    not have ipw2100/ipw2200 hardware, and there is no emulated device.

 drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c
index 6e16060834b8..d0352c8dc064 100644
--- a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c
+++ b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c
@@ -509,9 +509,9 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev)
 
       failed:
 	spin_unlock_irqrestore(&ieee->lock, flags);
-	netif_stop_queue(dev);
+	dev_kfree_skb_any(skb);
 	dev->stats.tx_errors++;
-	return NETDEV_TX_BUSY;
+	return NETDEV_TX_OK;
 }
 EXPORT_SYMBOL(libipw_xmit);
 

base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
-- 
2.53.0