Re: [PATCH rtw-next v4 1/3] wifi: rtl8xxxu: free RX skb when URB submission fails

[Ping-Ke Shih]

Kim Wooseok <5mghybrid@xxxxxxxxx> wrote:

> From: Kim Wooseok <5mghybrid@xxxxxxxxx>
> 
> When usb_submit_urb() fails, rtl8xxxu_submit_rx_urb() unanchors the URB
> but leaves the newly allocated skb in urb.context. For ENOMEM/EAGAIN,
> the RX worker puts the request back on the pending list. The next
> submission allocates another skb and overwrites that pointer, leaking
> the previous buffer. Stopping before the retry also leaks it, because
> pending-list cleanup frees only the URB.
> 
> Free the skb and clear urb.context in rtl8xxxu_submit_rx_urb() when
> submission fails. This keeps buffer allocation and failure cleanup in
> the same function, so a request returned for retry or teardown no longer
> owns an skb. Remove the corresponding cleanup from start and the RX
> worker; they only need to decide whether to retry or free the URB.
> 
> Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)")
> Reviewed-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
> Assisted-by: GPT-6 Astra
> Signed-off-by: Kim Wooseok <5mghybrid@xxxxxxxxx>

3 patch(es) applied to rtw-next branch of rtw.git, thanks.

9f7edf4e8584 wifi: rtl8xxxu: free RX skb when URB submission fails
4c58fb8944a2 wifi: rtl8xxxu: unwind incomplete receive startup
2f77c6669410 wifi: rtl8xxxu: preserve RX requests across recoverable transfer errors

---
https://github.com/pkshih/rtw.git