* [PATCH] wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
@ 2026-07-27 6:42 Abdun Nihaal
2026-07-27 6:53 ` Ping-Ke Shih
0 siblings, 1 reply; 2+ messages in thread
From: Abdun Nihaal @ 2026-07-27 6:42 UTC (permalink / raw)
To: pkshih; +Cc: Abdun Nihaal, linux-wireless, linux-kernel, stable
The skb passed to the rtw_hci_tx_write() is expected to be freed when
the function fails, but the error path in rtw_txq_push_skb() does not
free the skb before returning. This can lead to a memory leak in
rtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb().
Fixes: aaab5d0e6737 ("rtw88: kick off TX packets once for higher efficiency")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Issue found using static analysis
drivers/net/wireless/realtek/rtw88/tx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/realtek/rtw88/tx.c b/drivers/net/wireless/realtek/rtw88/tx.c
index 9d747a060b98..8786bbb421c2 100644
--- a/drivers/net/wireless/realtek/rtw88/tx.c
+++ b/drivers/net/wireless/realtek/rtw88/tx.c
@@ -619,6 +619,7 @@ static int rtw_txq_push_skb(struct rtw_dev *rtwdev,
ret = rtw_hci_tx_write(rtwdev, &pkt_info, skb);
if (ret) {
rtw_err(rtwdev, "failed to write TX skb to HCI\n");
+ ieee80211_free_txskb(rtwdev->hw, skb);
return ret;
}
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: [PATCH] wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
2026-07-27 6:42 [PATCH] wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal
@ 2026-07-27 6:53 ` Ping-Ke Shih
0 siblings, 0 replies; 2+ messages in thread
From: Ping-Ke Shih @ 2026-07-27 6:53 UTC (permalink / raw)
To: Abdun Nihaal
Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Abdun Nihaal <nihaal@cse.iitm.ac.in> wrote:
> The skb passed to the rtw_hci_tx_write() is expected to be freed when
> the function fails, but the error path in rtw_txq_push_skb() does not
> free the skb before returning. This can lead to a memory leak in
> rtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb().
>
> Fixes: aaab5d0e6737 ("rtw88: kick off TX packets once for higher efficiency")
> Cc: stable@vger.kernel.org
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-27 6:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-27 6:42 [PATCH] wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal
2026-07-27 6:53 ` Ping-Ke Shih
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox