[PATCH] wifi: mwifiex: Fix use after free in mwifiex_11n_dispatch_amsdu_pkt()
From: Dan Carpenter <hidden>
Date: 2026-01-08 19:57:42
Also in:
kernel-janitors, lkml
Subsystem:
marvell mwifiex wireless driver, the rest · Maintainers:
Brian Norris, Linus Torvalds
The ieee80211_amsdu_to_8023s() function generally frees the skb, so save
the skb->len first before it's freed.
Fixes: 776f742040ca ("mwifiex: fix AMPDU not setup on TDLS link problem")
Signed-off-by: Dan Carpenter <redacted>
---
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 354c5ce66045..90831a1350f5 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c@@ -25,6 +25,7 @@ static int mwifiex_11n_dispatch_amsdu_pkt(struct mwifiex_private *priv, if (le16_to_cpu(local_rx_pd->rx_pkt_type) == PKT_TYPE_AMSDU) { struct sk_buff_head list; + int skb_len = skb->len; struct sk_buff *rx_skb; __skb_queue_head_init(&list);
@@ -44,7 +45,7 @@ static int mwifiex_11n_dispatch_amsdu_pkt(struct mwifiex_private *priv, ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) { mwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr, - skb->len); + skb_len); } if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
--
2.51.0