From nobody Tue Jun 16 20:38:23 2026 Received: from n169-112.mail.139.com (n169-112.mail.139.com [120.232.169.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B88DD26B2DA; Tue, 21 Apr 2026 02:44:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=120.232.169.112 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776739472; cv=none; b=rNTfECwzP2PvljMH9rVe/E9hpho319Hx1Iy/ltz8IsAP2yBQDUWGAhmJO5CfOcLJo3N2cJ9pfg9upRMjDCZw8nsEYQ8H7I8UkRGSsiOyh3EU1MZHNm+YCeNojZuVWfni4IU3TNxIfIjAPi0BzXqskmyvXnu27fcNI/HSSlbgoUg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776739472; c=relaxed/simple; bh=mUs1vF9eqk+D7+IZ4R8oddL6sf7eMJULCmOr6/g/GGE=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=m6n4m+ZOjaO2BMrpGcw0Ob3fVQSpD4wYEhET7aeHVhvtk4GmvCaHeal7bdI1rKdJ0xu3oZnr+tQlBbBjGzoZ6CBZ5K/M3619ACc3ecUhBCAuVD78wWbgLoxZ7gwPujPpvR/jkFVbBLUJLMOsNUsJDaJnV9WIlENcHs8r4XM2s2I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=139.com; spf=pass smtp.mailfrom=139.com; dkim=pass (1024-bit key) header.d=139.com header.i=@139.com header.b=nv0pVy81; arc=none smtp.client-ip=120.232.169.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=139.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=139.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=139.com header.i=@139.com header.b="nv0pVy81" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=139.com; s=dkim; l=0; h=from:subject:message-id:to:cc:mime-version; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=; b=nv0pVy81nB8ijr8fH/wOse2fCi/ONoInZF85o3Fb1jlrQymUSl4NbDzKock5oHcGJqGHQm8DOy1Wd VYxRttoC2UAM95932WAvYz2D+x8a5JUcB3Xxo7TcZNsl/M9o8lmRHBLfJu+gHZPfYogpgc8N1lb9Sa 9BSTmHVrH/WLE9AU= X-RM-TagInfo: emlType=0 X-RM-SPAM: X-RM-SPAM-FLAG: 00000000 Received: from NTT-kernel-dev (unknown[60.247.85.88]) by rmsmtp-lg-appmail-20-12023 (RichMail) with SMTP id 2ef769e6e487384-013a1; Tue, 21 Apr 2026 10:44:26 +0800 (CST) X-RM-TRANSID: 2ef769e6e487384-013a1 From: Li hongliang <1468888505@139.com> To: gregkh@linuxfoundation.org, stable@vger.kernel.org, nbd@nbd.name Cc: patches@lists.linux.dev, linux-kernel@vger.kernel.org, toke@toke.dk, kvalo@kernel.org, johannes@sipsolutions.net, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, nbd@openwrt.org, linux-wireless@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, johannes.berg@intel.com Subject: [PATCH 5.10.y] wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Date: Tue, 21 Apr 2026 10:44:25 +0800 Message-Id: <20260421024425.3133110-1-1468888505@139.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Felix Fietkau [ Upstream commit d5ad6ab61cbd89afdb60881f6274f74328af3ee9 ] ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do. Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free. Document the skb ownership guarantee in the function's kdoc. Signed-off-by: Felix Fietkau Link: https://patch.msgid.link/20260314065455.2462900-1-nbd@nbd.name Fixes: 06be6b149f7e ("mac80211: add ieee80211_tx_prepare_skb() helper funct= ion") Signed-off-by: Johannes Berg [ Exclude changes to drivers/net/wireless/mediatek/mt76/scan.c as this file= is first introduced by commit 31083e38548f("wifi: mt76: add code for emulating hard= ware scanning") after linux-6.14.] Signed-off-by: Li hongliang <1468888505@139.com> --- drivers/net/wireless/ath/ath9k/channel.c | 6 ++---- drivers/net/wireless/mac80211_hwsim.c | 1 - include/net/mac80211.h | 4 ++++ net/mac80211/tx.c | 4 +++- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireles= s/ath/ath9k/channel.c index 6cf087522157..31b7921bf34f 100644 --- a/drivers/net/wireless/ath/ath9k/channel.c +++ b/drivers/net/wireless/ath/ath9k/channel.c @@ -1011,7 +1011,7 @@ static void ath_scan_send_probe(struct ath_softc *sc, skb_set_queue_mapping(skb, IEEE80211_AC_VO); =20 if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL)) - goto error; + return; =20 txctl.txq =3D sc->tx.txq_map[IEEE80211_AC_VO]; if (ath_tx_start(sc->hw, skb, &txctl)) @@ -1124,10 +1124,8 @@ ath_chanctx_send_vif_ps_frame(struct ath_softc *sc, = struct ath_vif *avp, =20 skb->priority =3D 7; skb_set_queue_mapping(skb, IEEE80211_AC_VO); - if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) { - dev_kfree_skb_any(skb); + if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) return false; - } break; default: return false; diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/m= ac80211_hwsim.c index 037358606a51..865bbe029343 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -2275,7 +2275,6 @@ static void hw_scan_work(struct work_struct *work) hwsim->tmp_chan->band, NULL)) { rcu_read_unlock(); - kfree_skb(probe); continue; } =20 diff --git a/include/net/mac80211.h b/include/net/mac80211.h index 8f91609f928c..70ee982f08d9 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -6337,6 +6337,10 @@ void ieee80211_report_wowlan_wakeup(struct ieee80211= _vif *vif, * @band: the band to transmit on * @sta: optional pointer to get the station to send the frame to * + * Return: %true if the skb was prepared, %false otherwise. + * On failure, the skb is freed by this function; callers must not + * free it again. + * * Note: must be called under RCU lock */ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw, diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 30ad46cfcad8..b923cd755a68 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1869,8 +1869,10 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *h= w, struct ieee80211_tx_data tx; struct sk_buff *skb2; =20 - if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) =3D=3D TX_DROP) + if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) =3D=3D TX_DROP) { + kfree_skb(skb); return false; + } =20 info->band =3D band; info->control.vif =3D vif; --=20 2.34.1