RE: [PATCH wireless 1/4] wifi: rtl8xxxu: free RX skb when URB submission fails

[Ping-Ke Shih]

Ping-Ke Shih <pkshih@xxxxxxxxxxx> wrote:
> kimwooseok <5mghybrid@xxxxxxxxx> wrote:
> > A failed RX URB submission can leak the skb allocated for that attempt.
> > rtl8xxxu_submit_rx_urb() allocates the buffer and stores it in urb.context,
> > but if usb_submit_urb() fails, it only unanchors the URB. The RX worker
> > queues ENOMEM/EAGAIN failures for retry with that buffer still attached.
> >
> > On the next attempt, rtl8xxxu_submit_rx_urb() allocates another skb and
> > overwrites urb.context, losing the reference to the previous buffer.
> > Stopping before the retry also leaks the buffer because pending-request
> > cleanup frees only the URB.
> >
> > Fix the leak at the submission failure by making rtl8xxxu_submit_rx_urb()
> > responsible for both allocating the skb and releasing it when submission
> > fails. Free the newly allocated skb and clear urb.context before returning
> > the error, so neither retry nor stop receives a pending URB that still
> > owns a buffer. Remove the caller-side skb cleanup from start and the RX
> > worker; those callers now handle only whether to retry or release the URB.
> >
> > Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)")
> > Assisted-by: GPT-6 Astra
> > Signed-off-by: kimwooseok <5mghybrid@xxxxxxxxx>
> 
> Can you give your s-o-b more formal? Like, Kim Woo-Seok?
> 
> Reviewed-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
> 

Ignore this. I should reply v2.