[PATCH] wifi: rtw88: fix skb leak in hw_scan probe request length check

[PATCH] wifi: rtw88: fix skb leak in hw_scan probe request length check

[Mauricio Faria de Oliveira]

In _rtw_hw_scan_update_probe_req(), if the first loop fails (goto out;) the
skb is leaked. It does not reach kfree_skb() at the end of the loop body or
in the second loop (out:) since it is unlinked from probe_req_list.

Fix the leak by calling kfree_skb() if the first loop fails.

In /sys/kernel/debug/kmemleak, after simulating the failure:

  unreferenced object 0xffff88810965a000 (size 232):
    comm "iw", pid 4729, jiffies 4345008185
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace (crc 20f7de11):
      kmem_cache_alloc_node_noprof+0x302/0x380
      __alloc_skb+0x74/0x2f0
      skb_copy+0x57/0xe0
      rtw_hw_scan_update_probe_req+0xff/0x230
      rtw_hw_scan_prehandle+0x4e/0x180
      rtw_hw_scan_offload+0x186/0x1d0
      rtw_ops_hw_scan+0x61/0xb0
      drv_hw_scan+0x81/0x130
      __ieee80211_start_scan+0x2e0/0x760
      rdev_scan+0x42/0x100
      nl80211_trigger_scan+0x53b/0x730
      genl_family_rcv_msg_doit+0x103/0x160
      genl_rcv_msg+0x1b5/0x2c0
      netlink_rcv_skb+0x52/0x100
      genl_rcv+0x28/0x40
      netlink_unicast+0x26d/0x3b0

This leak exists in the first loop since the function was introduced, and
still happened with the addition of the second loop, in these two commits:

Fixes: 10d162b2ed39 ("rtw88: 8822c: add ieee80211_ops::hw_scan")
Fixes: d95984b5580d ("rtw88: fix memory overrun and memory leak during hw_scan")
Signed-off-by: Mauricio Faria de Oliveira <mfo@igalia.com>
---
 drivers/net/wireless/realtek/rtw88/fw.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
index 945fedcd375b62b4110ab631e87889bb84e2f16b..09b5836540c41e80a5fecca0f781aa45c6327cc0 100644
--- a/drivers/net/wireless/realtek/rtw88/fw.c
+++ b/drivers/net/wireless/realtek/rtw88/fw.c
@@ -2061,6 +2061,7 @@ static int _rtw_hw_scan_update_probe_req(struct rtw_dev *rtwdev, u8 num_probes,
 		skb_unlink(skb, probe_req_list);
 		rtw_fill_rsvd_page_desc(rtwdev, skb, RSVD_PROBE_REQ);
 		if (skb->len > page_size * page_cnt) {
+			kfree_skb(skb);
 			ret = -EINVAL;
 			goto out;
 		}

---
base-commit: 7e1392a42ea288d70a266f6553fe06f57f8647ea
change-id: 20261112-rtw88-hw-scan-skb-leak-9e7154def3d5

Best regards,
-- 
Mauricio Faria de Oliveira <mfo@igalia.com>

Re: [PATCH] wifi: rtw88: fix skb leak in hw_scan probe request length check

[Luka Gejak]

On November 13, 2026 4:17:33 PM GMT+01:00, Mauricio Faria de Oliveira
<mfo@igalia.com> wrote:
>In _rtw_hw_scan_update_probe_req(), if the first loop fails (goto out;)
>the
>skb is leaked. It does not reach kfree_skb() at the end of the loop body
>or
>in the second loop (out:) since it is unlinked from probe_req_list.
>
>Fix the leak by calling kfree_skb() if the first loop fails.
>
>In /sys/kernel/debug/kmemleak, after simulating the failure:
>
>  unreferenced object 0xffff88810965a000 (size 232):
>    comm "iw", pid 4729, jiffies 4345008185
>    hex dump (first 32 bytes):
>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>    backtrace (crc 20f7de11):
>      kmem_cache_alloc_node_noprof+0x302/0x380
>      __alloc_skb+0x74/0x2f0
>      skb_copy+0x57/0xe0
>      rtw_hw_scan_update_probe_req+0xff/0x230
>      rtw_hw_scan_prehandle+0x4e/0x180
>      rtw_hw_scan_offload+0x186/0x1d0
>      rtw_ops_hw_scan+0x61/0xb0
>      drv_hw_scan+0x81/0x130
>      __ieee80211_start_scan+0x2e0/0x760
>      rdev_scan+0x42/0x100
>      nl80211_trigger_scan+0x53b/0x730
>      genl_family_rcv_msg_doit+0x103/0x160
>      genl_rcv_msg+0x1b5/0x2c0
>      netlink_rcv_skb+0x52/0x100
>      genl_rcv+0x28/0x40
>      netlink_unicast+0x26d/0x3b0
>

Should this dump go under --- so it doesn't end up in commit message?

>This leak exists in the first loop since the function was introduced, and
>still happened with the addition of the second loop, in these two commits:
>
>Fixes: 10d162b2ed39 ("rtw88: 8822c: add ieee80211_ops::hw_scan")
>Fixes: d95984b5580d ("rtw88: fix memory overrun and memory leak during hw_scan")

Should this perhaps cc stable?

>Signed-off-by: Mauricio Faria de Oliveira <mfo@igalia.com>
>---

Either way I'm fine with the code, so just fix the commit message. Feel
free to carry the tag for v2.

Reviewed-by: Luka Gejak <luka.gejak@linux.dev>

Best regards,
Luka Gejak