5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <redacted>
commit 9f2948010764d708bda27369d09ce6f194abe8e3 upstream.
The skb passed to the rtw_hci_tx_write() is expected to be freed when
the function fails, but the error path in rtw_txq_push_skb() does not
free the skb before returning. This can lead to a memory leak in
rtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb().
Fixes: aaab5d0e6737 ("rtw88: kick off TX packets once for higher efficiency")
Cc: <redacted>
Signed-off-by: Abdun Nihaal <redacted>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260727064223.61836-1-nihaal@cse.iitm.ac.in (local)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtw88/tx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/realtek/rtw88/tx.c
+++ b/drivers/net/wireless/realtek/rtw88/tx.c
@@ -547,6 +547,7 @@ static int rtw_txq_push_skb(struct rtw_d
ret = rtw_hci_tx_write(rtwdev, &pkt_info, skb);
if (ret) {
rtw_err(rtwdev, "failed to write TX skb to HCI\n");
+ ieee80211_free_txskb(rtwdev->hw, skb);
return ret;
}
rtwtxq->last_push = jiffies;