From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6ADE93CF212 for ; Wed, 15 Jul 2026 11:17:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784114243; cv=none; b=SkmZHSmGhlbv0+NsOrVtTwobVZ1k4xvm5O+gw1nPbUKdREGBg5YxcUC2F6MTINc385fi+qcb/aZL5/P7DO5uBKb6kouuRAJAo8E1D2KcVjt/JlaYh2gMOHwc+jEtp+eTYoG3tIfW8ZzSbFLCIQZlbCHvHIrrHtrcZ+YOEsz6CuY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784114243; c=relaxed/simple; bh=Vo3MuuffeObU4toTDwymqx6wj5UgGx6UqL3hNTXyqMw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=JQLbJI9yyQUtznMbOvJiF9jY0BsitE/rwn5RLMeprXZg5Qcfsutyw6AiXCSnurq7nxJVcDi+QJEBR0fo2J5WkBrqt0smGH27isovjLiUfd+KsQ88IW0iDuZRDXIB4pywiZNwSk6HaUy6oWOCrjAWtmJrNYHpEU7KXitbAc+iCcg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bsr5ZX2f; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bsr5ZX2f" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2cad8076b01so63375445ad.2 for ; Wed, 15 Jul 2026 04:17:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784114242; x=1784719042; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8waF9EW74z7Esj6+w6hWltBONCw/KZlMedKilRZKH2s=; b=bsr5ZX2fRgwOx1gq6ZYxgE3I8I+uj2WKbc+a3aGMq1NPn6JxOH+4P5rpqvvZ56JmFW jMMzsiBjrq2w//ORF9V6GRd0II+N4TuRVdpoIojJpoefBCHf1HgWDjnJH8wk384rtT39 J6VFXUZBhqd8F3lUsgfWM38R7+Ach2R/usFYJ+zYATNMoR7ucBhoSyvRWuru6hB72J8o vt6af/KByYyJIWVtOzaLx8+UPMJ1puVWr7MYDlLcAQB4AfkXLiBYoy1cg+LDdg69T6wN 0+ooqD5b4G/UiXBG7e97Np4OV424LzVRk1kWmOwMYIHCD/tPKfHI/+nISvF2FfkOldQo yeNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784114242; x=1784719042; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=8waF9EW74z7Esj6+w6hWltBONCw/KZlMedKilRZKH2s=; b=owBNUPzWRVdIFsEuHblR9S3+bKfIE8vfYFT8LPejQbLTK2bCZ1sc0zxfPEtwVu2up/ gZXUnopvsUMawrLV4sGyEGUq0aO4xi9Dn2Da5o20njLCAV+YIZhX0PJViRR/CkYEVkEA YBV3BvP5o/CtYcmrKDog3NzCSuzX83OD95Yau3IYiuZa54b9X9dYxNsWCIT2xiWS4/j9 q15IkkBqd+nIJ4D/G4LK1/Q1GROsuofLOJ4TQjMqt3MhPVkjmVDOZ5HyCGDEXBfrjvuB Qoq0o7kbWGXzJwBU66xQ8xAaIXiyreO+x51yi5RAYqnq89S/9zzmRT0b2ocFCxFVkkye tC8g== X-Forwarded-Encrypted: i=1; AHgh+Rrdvc6Q1OGVODrH48VDYC5jgGtLG8dj8TglYZefJvykqEB4wLFR/vxt5yRpi8YYNphCFddPQ1vrxJlFZbs=@vger.kernel.org X-Gm-Message-State: AOJu0YzxS1UxwkxbutLyqkBuisBDbwP46bGauqIKfGxD+EaztmeggjYB tkGExuYp9EsJCNxtQUKNGcmp1DI6dBH5uDT45/uudEJg3fziytmc3Ltb X-Gm-Gg: AfdE7cmvLeAJFEIZ2WbDG/e+lxmLmS3b6aXMFNwC2w/mDANtB3dZYGZSIGBT0AWMb59 zgAiHh8okr4I4wwbl9oahgz6hJAxtDxh8m1JSGkZPhIGsTvKIO5+M8V5QbgxDJKchw+MapI/CVh 4HIKsT6LVmQffWruav7heGfrlvBlmE+u8Te+zqD4ZDnekHdwd4BMnuriJbQZx/IKUY5TPDwLjGn wmZEPEaXskZlCU3ZonjgMLFrM+mgb+VXnUYTIRnRXZdKtn7RRLsFJ0giBZbJtJkDYNGjV8NeeDL u+eDENRV9twEblaCX9JehP49OqtyPJ4cpQaFf6LYZSwwvdmw9OF937wmOF9R6tn6r86oeVCazbX R0b5WcAVe4KxA2QYA515E1zhQ1/ZtL184x38v8lltAzueha/QvXUfM0ueCOyvYHN46EYUlm2m8+ C1WRKLZuMSndcq+t+/3WbJeXtHPLapGw== X-Received: by 2002:a17:902:da89:b0:2b7:975c:dacc with SMTP id d9443c01a7336-2cee9a650ecmr76181715ad.1.1784114241648; Wed, 15 Jul 2026 04:17:21 -0700 (PDT) Received: from SGN-LDSENG.tasernet.com ([2405:4800:5cc3:11a:1ac0:4dff:fe8b:4a69]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf10701ab0sm467845ad.77.2026.07.15.04.17.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 04:17:21 -0700 (PDT) From: Cong Nguyen To: Greg Kroah-Hartman Cc: Dan Carpenter , linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Cong Nguyen Subject: [PATCH v2] staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths Date: Wed, 15 Jul 2026 18:17:10 +0700 Message-Id: <20260715111710.295052-1-congnt264@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20260714163525.175763-1-congnt264@gmail.com> References: <20260714163525.175763-1-congnt264@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from the driver's fixed-size management-TX pools via alloc_mgtxmitframe(). On the normal path the frame is handed to dump_mgntframe(), which transfers ownership and eventually returns both objects to their pools (the frame and, for beacons, the buf in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion path). Several error/edge paths return early after a successful alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never transferred and neither object is freed: - issue_beacon(): beacon larger than 512 bytes - issue_probersp(): cur_network->ie_length > MAX_IE_SZ - issue_probersp(): kzalloc() of the SSID scratch buffer fails - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP Because alloc_mgtxmitframe() removes the frame and buf from their free lists (list_del_init) without placing them on any pending list, an orphaned pair is on no list and referenced by nobody, so it is only reclaimed at driver teardown. Repeated hits progressively exhaust the management-TX pools until alloc_mgtxmitframe() returns NULL and the interface can no longer send beacons or probe/assoc responses. Free the frame and buffer on these paths, matching the existing correct error handling in issue_assocreq(). Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Cong Nguyen Reviewed-by: Dan Carpenter --- v2: - Add Fixes tag (Dan Carpenter) drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 22 ++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c index 8cf3c14a0dd7..354acd7ceb6f 100644 --- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c @@ -2196,8 +2196,11 @@ void issue_beacon(struct adapter *padapter, int timeout_ms) spin_unlock_bh(&pmlmepriv->bcn_update_lock); - if ((pattrib->pktlen + TXDESC_SIZE) > 512) + if ((pattrib->pktlen + TXDESC_SIZE) > 512) { + rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf); + rtw_free_xmitframe(pxmitpriv, pmgntframe); return; + } pattrib->last_txcmdsz = pattrib->pktlen; @@ -2258,8 +2261,11 @@ void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p pattrib->pktlen = pattrib->hdrlen; pframe += pattrib->hdrlen; - if (cur_network->ie_length > MAX_IE_SZ) + if (cur_network->ie_length > MAX_IE_SZ) { + rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf); + rtw_free_xmitframe(pxmitpriv, pmgntframe); return; + } if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE) { pwps_ie = rtw_get_wps_ie(cur_network->ies + _FIXED_IE_LENGTH_, @@ -2309,8 +2315,11 @@ void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p sizeof(struct ieee80211_hdr_3addr); buf = kzalloc(MAX_IE_SZ, GFP_ATOMIC); - if (!buf) + if (!buf) { + rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf); + rtw_free_xmitframe(pxmitpriv, pmgntframe); return; + } ssid_ie = rtw_get_ie(ies + _FIXED_IE_LENGTH_, WLAN_EID_SSID, &ssid_ielen, (pframe - ies) - _FIXED_IE_LENGTH_); @@ -2689,10 +2698,13 @@ void issue_asocrsp(struct adapter *padapter, unsigned short status, struct sta_i SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq); pmlmeext->mgnt_seq++; - if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP)) + if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP)) { SetFrameSubType(pwlanhdr, pkt_type); - else + } else { + rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf); + rtw_free_xmitframe(pxmitpriv, pmgntframe); return; + } pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr); pattrib->pktlen += pattrib->hdrlen; -- 2.25.1