From nobody Mon Jul 27 19:00:15 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BFFB37C0ED for ; Thu, 16 Jul 2026 16:25:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784219124; cv=none; b=ihqGD6t/jVR+2DTvyC9AU4iHbxO1YYJM7L7WUf0BtW8+1AcdyPtB7zIyR8W0HC0abhcCkc3msPKW3+VdKNdt2iIBC/+rVd+mLDB4cx7k7hsTKAOAZqpAlUsgEi0MQ3nyUtTQqHeMUyKDGg+032Ky+iD8rcYEDbpxbl8/UotmBgM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784219124; c=relaxed/simple; bh=4CPW5b7K7pWIDEETkd1lpdofQroaGErs1xlq/gmjxWI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=scj0zf+egvgpgh6TiR0IbpqpSYEHKQX8LeTuIqVOQWYnlC2iiH2nlTiKKHHJKGDdKnMd5eTu9JePctp0eNvcagblYBOakcl5xc32I15VfPJT5sOAnuaVbhnDreMev9w9ik6JAwfgYar1Cy4PlJP6etOoqS49WCTBZ9tfvO47W2M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VFWIjBHe; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VFWIjBHe" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38e42560ebcso495360a91.1 for ; Thu, 16 Jul 2026 09:25:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784219122; x=1784823922; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7QjVN0B7Sf4bom6cy6/CS1jzJRC2l2ZaheSobQTYPio=; b=VFWIjBHe7jK8962+U9Mp6Kwdwry1GSS0pHQ6YrkezNUq2JiP5SiuP07+slTy3HIlsc oKlekvyJz/FKN0Uz8O8LKOhX1j07GYjXRVVi21z43ZzePn+f3wFgrpfEM4scOcOLWK2h L6KKNFIYmafxMRwi9biVyBgjGm4/kmdModk+lBpL4QCQem9gf+tOzg/T0jdaQoI1viFy kfN06+wgDtdVQ1qUZ1+fabwx4P5xRVitvdVHTt3j0sp3TmIHrZULcbLVXSgcwPDMvtN2 Y8qQ2sGfH5m+/aOfC0xZ2h1Wj2dSSJolzA8Of9tqAluALNmxM2ZFDnDOqtg8HbEvycQV waqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784219122; x=1784823922; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=7QjVN0B7Sf4bom6cy6/CS1jzJRC2l2ZaheSobQTYPio=; b=UITonUZpApAu3s5XzDEZfgGBR268UifNap/Ia7ZcLITy2dAs9C1tJLQhDj+avprCxb KNKoQlE4Nh4Ia48SgMW2nxo1JKFWWrNYtU7qOHvik6pDTmWX5Mtl11f6O4jaFiAaRLdv ktBzyPwsFaNlZo7fhYkxU/DQA0fZ4S9QY/gzeeOci4i9N1bZ5afDsB6+ECcs+fGKC1Ip 6lqBFBYA/1JxXV2qpy4WxmSbJJ7b7V7STPljB2pOsA5EHBOFPDZbgjmskRwqnnMJq0Xi ByvNcqGIPCh7oWoZUWlVIkBldBr2ufQOw2MbTxGzHW3mkQ0/PkBUn9HcAX+sjDgCH7+R khHA== X-Forwarded-Encrypted: i=1; AHgh+RrnV5zZNirOjOByZ7JpZCH0INipU/M+tzfxhgg1vXVQTDJM18dNODqGQ77cbRFHCrqNhT6USik3QOH1gMc=@vger.kernel.org X-Gm-Message-State: AOJu0YzmCGiqBbSCBtxj5pwnb4chWtnJtXf9sSBZit29zObB3/qbyqLy 1jsrpZJvzQlZoLJeycdGt24HekkHvsTDnmsWB7c9qy7zlYcQ0j3s9rs3 X-Gm-Gg: AfdE7cmuUrZDd9oF+dGQzx8PYRsx98T4NW642xwDCk8AJiggF6Ko1hLf/8np8cGs/GH vxrHZJUqN6kOwHlnY0C6iiZdLXO1vej0wdUYEo1JWJrnJ13YRcOZRzHdZHo+cBLOJ8D75Pyd2oU 6AQA7jEAtFDQ1CzUqlBzJqWyFYmrN2G6Op8gWlez9WMcs28WdWQQg+7e+4pDblQVBjd5U5ne0VO L9bYBdUhYsaypwU3acDdnPN1UHE9iu8LEyOzESUI5plqt07K0xaV06Wtlu1wrLUavxicu7rLiwo d4QvYQySKT+J4FGQELVoJJLNljZDmbyH4xjCEPvu33Xwh8ICEnM69cbQ6qQ5knOUtI6bjd3B7SY OIUmO2pfAC6b1cjOGSzjTamL9TX8O1hL9+SrzXQ0rMzHqE3DEOz72EsyOJ8ov3N//lhb8TyTKs4 PgkqcEoFHOBVRMSQkiK/Vv3wklcWKrJZY/XaHnMcvUiWPe5foOXrMf120oN40O/BsWV8Rl8AY1C Unq6ldm+RA= X-Received: by 2002:a17:90b:268a:b0:38d:e442:901e with SMTP id 98e67ed59e1d1-38e4676edcemr252375a91.27.1784219121817; Thu, 16 Jul 2026 09:25:21 -0700 (PDT) Received: from [192.168.1.45] ([45.64.226.73]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3140e6f0fcdsm13401269eec.30.2026.07.16.09.25.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jul 2026 09:25:21 -0700 (PDT) From: Prashant Rahul Date: Thu, 16 Jul 2026 21:55:10 +0530 Subject: [PATCH] wifi: mt76: mt7921: fix memory leak when skb_linearize fails in mcu rx event Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260716-mt7921-mem-leak-v1-1-6e9c0ea19f63@gmail.com> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/x3MQQ5AMBBA0avIrE3SqURxFbGoGkwo0opIxN01l m/x/wORg3CEJnsg8CVR9i2B8gzcbLeJUYZk0EqXylCJ/jS1JvTscWW7oC0q1zsaKio0pOoIPMr 9H9vufT+KAS/7YQAAAA== X-Change-ID: 20260716-mt7921-mem-leak-a38cbc1d8132 To: Felix Fietkau , Lorenzo Bianconi , Ryder Lee , Shayne Chen , Sean Wang , Matthias Brugger , AngeloGioacchino Del Regno Cc: Shuah Khan , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Prashant Rahul X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=1673; i=prashantrahul23@gmail.com; h=from:subject:message-id; bh=4CPW5b7K7pWIDEETkd1lpdofQroaGErs1xlq/gmjxWI=; b=owEBbQKS/ZANAwAKAWw+kajX8DhtAcsmYgBqWQXsV/w68cO9EKUlxqIpVZZtXkCX80D6dDxmD aGf8enZNumJAjMEAAEKAB0WIQRS5esR6MP3hQs0SsxsPpGo1/A4bQUCalkF7AAKCRBsPpGo1/A4 bdceD/9HRbFIUqlRohA+MNVpogcl2J0qVq6PkEnpD+GkH7o7uXwvTr5omWzmRqdNb33V5b4Fe2K c7OJF/5NoVkMxl6Qpc35kmyjgwc6XTpUewiJRb79q3tPiZV0GG8QuRVtllKz831mDYmPk+Redck 4H5KTYrsr8LIf9Xso8dlfOJN0ERKdNUzEwDPcyLSuH+m/xuIDs3ez5Y5IKNCanUcpVK5onVkMFk 0hudLISYFa8W/s9wIKM6pSuqHZ5JqWA5SYbsh6Wvq8H9DLcMa9uYgDbd7cN1rUF9ZfOWg7BLDXY z616o9dBYz8yUev0+lQAM2omnXDbaKRnEOoF+FKv21HScW3bH8AGZJLoAPJgoeMGHIysFEtpdEI +85iKhG2ybdPp5FL+I+AteyRTxrnH+O1mpS5AoFksYcv/qEQaIM2R8LePjvtSwTPk13dGVwdm3P 3MY/2bz9TLpgdi51R4hn89CJiCZ48nVMUKABUTky/G80vg4b/pyYsa6jNuT5wEhVgYOFXqz3qko GfYjZThToIzvU+crLj4s49Zh7/ceI//3hrH84W6MAL3FM2jjNXBihLDv077WFmv4/AXOEWbVsHs qtnO5CTz3MKT9+K0Dq36YNx07UYI1d6sNTiBka3HlCEkxRXgRR3zbIId2eZH3SiKscIsUTumMjr pli4IGgKPuxzQxA== X-Developer-Key: i=prashantrahul23@gmail.com; a=openpgp; fpr=52E5EB11E8C3F7850B344ACC6C3E91A8D7F0386D The ownership of sk_buff skb is passed to mt7921_queue_rx_skb, each path inside it under the switch case handles cleaning of skb and it is true for mt7921_mcu_rx_event as well. mt7921_mcu_rx_event, on a success path, either queues skb via mt76_mcu_rx_event or cleans it immediately inside mt7921_mcu_uni_rx_unsolicited_event. However inside mt7921_mcu_rx_event, if skb_linearize fails, the function returns immediately and never bothers cleaning skb which leaks skb. Since skb is fully owned at this point, it is safe to call dev_kfree_skb which fixes the leak. Granted, the skb_linearize failure is rare as it can only fail under heavy memory usage, but at the same time, leaking memory under heavy memory usage can worsen the OOM condition. Signed-off-by: Prashant Rahul --- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/= wireless/mediatek/mt76/mt7921/mcu.c index 25b9437250f7b..fb18d3b4e27ba 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c @@ -351,8 +351,10 @@ void mt7921_mcu_rx_event(struct mt792x_dev *dev, struc= t sk_buff *skb) { struct mt76_connac2_mcu_rxd *rxd; =20 - if (skb_linearize(skb)) + if (skb_linearize(skb)) { + dev_kfree_skb(skb); return; + } =20 rxd =3D (struct mt76_connac2_mcu_rxd *)skb->data; =20 --- base-commit: b8809969e1d7a591e0f49dd464a5d04b3cf02ab1 change-id: 20260716-mt7921-mem-leak-a38cbc1d8132 Best regards, --=20 Prashant Rahul