gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: do not free skb on ieee80211_tx_prepare_skb failure

Browse Source 
ieee80211_tx_prepare_skb already frees the skb internally when
invoke_tx_handlers fails, so freeing it again in the caller leads to a
double-free / NULL pointer dereference in skb_release_data.

Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2026-03-10 14:46:09 +00:00
parent ab6abc9713
commit d2b1e1aa8e
2 changed files with 2 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mac80211.c
+1 -3
View File
@@ -2168,10 +2168,8 @@ mt76_offchannel_send_nullfunc(struct mt76_offchannel_cb_data *data,
if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb,
phy->main_chandef.chan->band,
&sta)) {
ieee80211_free_txskb(phy->hw, skb);
&sta))
return;
}
if (sta)
wcid = (struct mt76_wcid *)sta->drv_priv;
scan.c
+1 -3
View File
@@ -69,10 +69,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid)
rcu_read_lock();
if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {
ieee80211_free_txskb(phy->hw, skb);
if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))
goto out;
}
info = IEEE80211_SKB_CB(skb);
if (req->no_cck)