[PATCH ath-next 0/2] wifi: ath11k/ath12k: fix a double free when the first fragment's descriptor copy fails

[Adriel Santos <adriel@adriel.eu>]

In both drivers, the RX defragmentation path queues fragment 0 before it
copies the fragment's REO destination descriptor. If that GFP_ATOMIC copy
fails, the caller frees the skb while it is still queued, which leads to a
double free or a use after free plus a NULL dereference on reinjection.
Both patches move the copy before the queueing.

Patch 1 was tested on IPQ5018 on an OpenWrt backports tree, with forced
allocation failures (details in its notes); patch 2 is compile tested
only.

Both bugs were found during an LLM-assisted review of the RX fragment
handling, and an LLM coding assistant also helped write the patches and
run the bench tests described in patch 1's notes. I reviewed the
analysis, the code and the test results, and I am responsible for both
patches.

Adriel Santos (2):
  wifi: ath11k: copy the first fragment's descriptor before queuing it
  wifi: ath12k: copy the first fragment's descriptor before queuing it

 drivers/net/wireless/ath/ath11k/dp_rx.c       | 22 ++++++++++---------
 drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 22 ++++++++++---------
 2 files changed, 24 insertions(+), 20 deletions(-)

-- 
2.47.3