From d2b1e1aa8ec4636fb216194120ea0ed74fc8b094 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 10 Mar 2026 14:46:09 +0000 Subject: [PATCH] wifi: mt76: do not free skb on ieee80211_tx_prepare_skb failure ieee80211_tx_prepare_skb already frees the skb internally when invoke_tx_handlers fails, so freeing it again in the caller leads to a double-free / NULL pointer dereference in skb_release_data. Signed-off-by: Felix Fietkau --- mac80211.c | 4 +--- scan.c | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/mac80211.c b/mac80211.c index cf3a4c07..084d9ccb 100644 --- a/mac80211.c +++ b/mac80211.c @@ -2168,10 +2168,8 @@ mt76_offchannel_send_nullfunc(struct mt76_offchannel_cb_data *data, if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, phy->main_chandef.chan->band, - &sta)) { - ieee80211_free_txskb(phy->hw, skb); + &sta)) return; - } if (sta) wcid = (struct mt76_wcid *)sta->drv_priv; diff --git a/scan.c b/scan.c index fbc10c96..7fe1b1fb 100644 --- a/scan.c +++ b/scan.c @@ -69,10 +69,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid) rcu_read_lock(); - if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) { - ieee80211_free_txskb(phy->hw, skb); + if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) goto out; - } info = IEEE80211_SKB_CB(skb); if (req->no_cck)