From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2442731C56D for ; Tue, 14 Jul 2026 16:35:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784046939; cv=none; b=H1ut3SVd6l6GioLq42MVtyHH6hxVcvXivbX7SfJOS6+S2CQWp8DA3gzItooUsV5Tf3IWteqmzeI6WlcgW8wX8siQ+D3PyKGuauztvelsrzo2+UUYhOFj0kEfbMrseIXSMvWsfqZ9mFNkQAgW4JuztlJcM+4uln1WiuV9wzAyorw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784046939; c=relaxed/simple; bh=aXoqXXMCG0cP/j8pfnMB6mvoTBg1tx08EmT2y2G9YAQ=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=XhN9Qf6lSG71ibITbBpDKrda4hw0n0xKRtcu1emgo/+fT3/1T/QRRY+0GLV4w7iZ0/X51EqBAXCGzXPiINE7X6HF8vJOyIHLJ2KVNF/qCh78HXsrv5idFH9acEyZhMmiLkzqTCEbzC3Ac8cDfWxSszn/CaIDOsLpFDJzafkip4o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=I1ddKlsa; arc=none smtp.client-ip=209.85.210.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="I1ddKlsa" Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-8486672f03cso4165567b3a.0 for ; Tue, 14 Jul 2026 09:35:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784046937; x=1784651737; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=XaWCHcAmhDdt3u4ekwE5i5dlNmDWEw+44WeSeauVCtI=; b=I1ddKlsa7cFqveJo/JrUF2/U4eY5ADlMl39KQI0MvRra8R2R4tfQG2EUfqgQgTZtw2 syMv8UAOuE4eqY7k4GdQTTOpLBlf4fLq54ImS2ofRTZxrQS144qjmG4m6+nsLU/zhP8G jqK2ZW2CoMiloU6Sf05upy6fs3Cju+1/TIiYjawelLVaH0zh3oIVfdOuOuFWfakM5iZO mlyb3vAbOasD15Dq0ecVEayAjV9C+hkB4j1K8YNoS7RHLM1oN6CoHO0X375hy/z+MNN5 n1EzMkBDD3aP48Qk5iWh1kcARvB66MF/qphAt3DPtNxR/DfUgwbRu/dbh4KEdMmzdUBD LI0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784046937; x=1784651737; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XaWCHcAmhDdt3u4ekwE5i5dlNmDWEw+44WeSeauVCtI=; b=WFAzhJUbv1SuA6RWOxDxh0vgy/o6pAlagTWWYrd1eiWTQ8tnVtJiaDCZwj51iiWyz0 YMBSnLmJUCynpYqIUo9t2QHsyvxBzsGiHdD9ycrx+05bt6j2ggwVltaXZT/zIcaJadac ZjPxu3tNKwyobWk7K5nU+/wSRzyE9L2q46sFT4BBmFoiQ4OKcfh7uM3uA0HYKhZ9/SeU Rx/aEoN/s/M1qbJrAebb7c9HxKDsrPvslBr/FApkxFJuoRp3boOxWrMuDZvOe2Rp8+KY vihRWKfrY8j1rnbX0yYaj9ke/pXLtKdZ+DA0EHKVRxcUE9rOiXLYenj5OP8SudG7sQBG UsQw== X-Forwarded-Encrypted: i=1; AHgh+RplCIkUinjR0xP/npJghGSGO43YOlbAkv34LsITcxQPTD+AhfxIGFTNjpkzIMfuMkIf7sFzyORn7NLVgPE=@vger.kernel.org X-Gm-Message-State: AOJu0YzXH8NA7t2AbW7cAYZ0fBONrYTs09gOEv6GC5yWmG1I4oWyodEb ef/ydXGwVr55taqEzBY5METMNDgDhNggOtaAm41RUDZ0axMKBUQapX6r X-Gm-Gg: AfdE7cllWrzemmzoeDHeczhizTpyikRxuN1d8BWuvhqhRzCmKgXiNURBxpwYk3eZp3k Omb4j8rFKpG7hHdsA3OwQWB39EEs6M3r5GmKLoLNojKFF5qrQTBII3f8JLut5wsOVeTQzN7zJvr 8ORF0oTdLluVgkIj7BUBDXDmU2+lEePX4gbVNMzeRXHY9zvpJP0uqocDecFjH4UM1nsnj46HmoL OpPAhcRGj1hy5vQ0OiU5LsQXXxuxs1Z5r9A1YvDd3yAtxWSFXrqa/WKPKFInYICBmr7jF2h2Xfh JDOYc5K9VVOGk4eKwEuimqdXoGFc9hyZKqfBfgJfUc9EW7DEi+18icdm3SyNKdCAfzCi5Mjil4L odxIPsIwqI3O4K8VaWGmwdWucSWa8TlH5I4ZwrKNX1IR75WILbD4DfPi411pIsCft+xEQRpXAmT wViq+7T928Gr4Gl0XWvI6aB/iKHQQv6/azSp48eAph X-Received: by 2002:a05:6a00:1804:b0:847:711f:49ab with SMTP id d2e1a72fcca58-8488961b62cmr13385114b3a.22.1784046937413; Tue, 14 Jul 2026 09:35:37 -0700 (PDT) Received: from SGN-LDSENG.tasernet.com ([2405:4800:5cc3:11a:1ac0:4dff:fe8b:4a69]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84a4f7de23asm1786227b3a.49.2026.07.14.09.35.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 09:35:37 -0700 (PDT) From: Cong Nguyen To: Greg Kroah-Hartman Cc: Dan Carpenter , linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Cong Nguyen Subject: [PATCH] staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths Date: Tue, 14 Jul 2026 23:35:25 +0700 Message-Id: <20260714163525.175763-1-congnt264@gmail.com> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from the driver's fixed-size management-TX pools via alloc_mgtxmitframe(). On the normal path the frame is handed to dump_mgntframe(), which transfers ownership and eventually returns both objects to their pools (the frame and, for beacons, the buf in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion path). Several error/edge paths return early after a successful alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never transferred and neither object is freed: - issue_beacon(): beacon larger than 512 bytes - issue_probersp(): cur_network->ie_length > MAX_IE_SZ - issue_probersp(): kzalloc() of the SSID scratch buffer fails - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP Because alloc_mgtxmitframe() removes the frame and buf from their free lists (list_del_init) without placing them on any pending list, an orphaned pair is on no list and referenced by nobody, so it is only reclaimed at driver teardown. Repeated hits progressively exhaust the management-TX pools until alloc_mgtxmitframe() returns NULL and the interface can no longer send beacons or probe/assoc responses. Free the frame and buffer on these paths, matching the existing correct error handling in issue_assocreq(). Signed-off-by: Cong Nguyen --- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 22 ++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c index 8cf3c14a0dd7..354acd7ceb6f 100644 --- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c @@ -2196,8 +2196,11 @@ void issue_beacon(struct adapter *padapter, int timeout_ms) spin_unlock_bh(&pmlmepriv->bcn_update_lock); - if ((pattrib->pktlen + TXDESC_SIZE) > 512) + if ((pattrib->pktlen + TXDESC_SIZE) > 512) { + rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf); + rtw_free_xmitframe(pxmitpriv, pmgntframe); return; + } pattrib->last_txcmdsz = pattrib->pktlen; @@ -2258,8 +2261,11 @@ void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p pattrib->pktlen = pattrib->hdrlen; pframe += pattrib->hdrlen; - if (cur_network->ie_length > MAX_IE_SZ) + if (cur_network->ie_length > MAX_IE_SZ) { + rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf); + rtw_free_xmitframe(pxmitpriv, pmgntframe); return; + } if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE) { pwps_ie = rtw_get_wps_ie(cur_network->ies + _FIXED_IE_LENGTH_, @@ -2309,8 +2315,11 @@ void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p sizeof(struct ieee80211_hdr_3addr); buf = kzalloc(MAX_IE_SZ, GFP_ATOMIC); - if (!buf) + if (!buf) { + rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf); + rtw_free_xmitframe(pxmitpriv, pmgntframe); return; + } ssid_ie = rtw_get_ie(ies + _FIXED_IE_LENGTH_, WLAN_EID_SSID, &ssid_ielen, (pframe - ies) - _FIXED_IE_LENGTH_); @@ -2689,10 +2698,13 @@ void issue_asocrsp(struct adapter *padapter, unsigned short status, struct sta_i SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq); pmlmeext->mgnt_seq++; - if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP)) + if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP)) { SetFrameSubType(pwlanhdr, pkt_type); - else + } else { + rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf); + rtw_free_xmitframe(pxmitpriv, pmgntframe); return; + } pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr); pattrib->pktlen += pattrib->hdrlen; -- 2.25.1