RE: [PATCH wireless 1/4] wifi: rtl8xxxu: free RX skb when URB submission fails

[Ping-Ke Shih]

kimwooseok <5mghybrid@xxxxxxxxx> wrote:
> A failed RX URB submission can leak the skb allocated for that attempt.
> rtl8xxxu_submit_rx_urb() allocates the buffer and stores it in urb.context,
> but if usb_submit_urb() fails, it only unanchors the URB. The RX worker
> queues ENOMEM/EAGAIN failures for retry with that buffer still attached.
> 
> On the next attempt, rtl8xxxu_submit_rx_urb() allocates another skb and
> overwrites urb.context, losing the reference to the previous buffer.
> Stopping before the retry also leaks the buffer because pending-request
> cleanup frees only the URB.
> 
> Fix the leak at the submission failure by making rtl8xxxu_submit_rx_urb()
> responsible for both allocating the skb and releasing it when submission
> fails. Free the newly allocated skb and clear urb.context before returning
> the error, so neither retry nor stop receives a pending URB that still
> owns a buffer. Remove the caller-side skb cleanup from start and the RX
> worker; those callers now handle only whether to retry or release the URB.
> 
> Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)")
> Assisted-by: GPT-6 Astra
> Signed-off-by: kimwooseok <5mghybrid@xxxxxxxxx>

Can you give your s-o-b more formal? Like, Kim Woo-Seok?

Reviewed-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>