Re: [PATCH] wifi: rtw88: fix skb leak in hw_scan probe request length check

[Luka Gejak <luka.gejak@linux.dev>]

On November 13, 2026 4:17:33 PM GMT+01:00, Mauricio Faria de Oliveira
<mfo@igalia.com> wrote:
>In _rtw_hw_scan_update_probe_req(), if the first loop fails (goto out;)
>the
>skb is leaked. It does not reach kfree_skb() at the end of the loop body
>or
>in the second loop (out:) since it is unlinked from probe_req_list.
>
>Fix the leak by calling kfree_skb() if the first loop fails.
>
>In /sys/kernel/debug/kmemleak, after simulating the failure:
>
>  unreferenced object 0xffff88810965a000 (size 232):
>    comm "iw", pid 4729, jiffies 4345008185
>    hex dump (first 32 bytes):
>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>    backtrace (crc 20f7de11):
>      kmem_cache_alloc_node_noprof+0x302/0x380
>      __alloc_skb+0x74/0x2f0
>      skb_copy+0x57/0xe0
>      rtw_hw_scan_update_probe_req+0xff/0x230
>      rtw_hw_scan_prehandle+0x4e/0x180
>      rtw_hw_scan_offload+0x186/0x1d0
>      rtw_ops_hw_scan+0x61/0xb0
>      drv_hw_scan+0x81/0x130
>      __ieee80211_start_scan+0x2e0/0x760
>      rdev_scan+0x42/0x100
>      nl80211_trigger_scan+0x53b/0x730
>      genl_family_rcv_msg_doit+0x103/0x160
>      genl_rcv_msg+0x1b5/0x2c0
>      netlink_rcv_skb+0x52/0x100
>      genl_rcv+0x28/0x40
>      netlink_unicast+0x26d/0x3b0
>

Should this dump go under --- so it doesn't end up in commit message?

>This leak exists in the first loop since the function was introduced, and
>still happened with the addition of the second loop, in these two commits:
>
>Fixes: 10d162b2ed39 ("rtw88: 8822c: add ieee80211_ops::hw_scan")
>Fixes: d95984b5580d ("rtw88: fix memory overrun and memory leak during hw_scan")

Should this perhaps cc stable?

>Signed-off-by: Mauricio Faria de Oliveira <mfo@igalia.com>
>---

Either way I'm fine with the code, so just fix the commit message. Feel
free to carry the tag for v2.

Reviewed-by: Luka Gejak <luka.gejak@linux.dev>

Best regards,
Luka Gejak