From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Yuho Choi <dbgh9129@gmail.com>
Cc: linux-staging@lists.linux.dev, Hans de Goede <hansg@kernel.org>,
Michael Straube <straube.linux@gmail.com>,
Andy Shevchenko <andriy.shevchenko@intel.com>,
Minu Jin <s9430939@naver.com>,
Omer El Idrissi <omer.e.idrissi@gmail.com>,
William Hansen-Baird <william.hansen.baird@gmail.com>,
Ethan Tidmore <ethantidmore06@gmail.com>,
Ingo Molnar <mingo@kernel.org>,
linux-kernel@vger.kernel.org, Myeonghun Pak <mhun512@gmail.com>,
Ijae Kim <ae878000@gmail.com>, Taegyu Kim <tmk5904@psu.edu>
Subject: Re: [PATCH v1] staging: rtl8723bs: fix stale recv_frame free in recv_func_posthandle()
Date: Mon, 20 Apr 2026 12:05:40 +0200 [thread overview]
Message-ID: <2026042006-deploy-cause-dc65@gregkh> (raw)
In-Reply-To: <20260420042734.3685-1-dbgh9129@gmail.com>
On Mon, Apr 20, 2026 at 12:27:34AM -0400, Yuho Choi wrote:
> recv_func_posthandle() saved the original recv_frame pointer before
> calling recvframe_chk_defrag().
>
> On the last-fragment reassembly path, recvframe_chk_defrag() may return
> the first fragment as the new frame while freeing the original
> last-fragment frame when draining the defrag queue.
>
> If process_recv_indicatepkts() then fails, recv_func_posthandle() frees
> the saved pre-defrag pointer again, which can result in a stale pointer
> free.
>
> Free the current recv_frame on the failure path instead of the saved
> pre-defrag pointer.
Can you cause this to happen in any way? Given the age of this code,
and the crazy paths here, I'm loath to change this without lots of
testing with a real device, have you done so?
thanks,
greg k-h
next prev parent reply other threads:[~2026-04-20 10:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-20 4:27 [PATCH v1] staging: rtl8723bs: fix stale recv_frame free in recv_func_posthandle() Yuho Choi
2026-04-20 8:27 ` Andy Shevchenko
2026-04-20 10:05 ` Greg Kroah-Hartman [this message]
2026-04-20 14:20 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026042006-deploy-cause-dc65@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=ae878000@gmail.com \
--cc=andriy.shevchenko@intel.com \
--cc=dbgh9129@gmail.com \
--cc=ethantidmore06@gmail.com \
--cc=hansg@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=mhun512@gmail.com \
--cc=mingo@kernel.org \
--cc=omer.e.idrissi@gmail.com \
--cc=s9430939@naver.com \
--cc=straube.linux@gmail.com \
--cc=tmk5904@psu.edu \
--cc=william.hansen.baird@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox