Re: [PATCH] wifi: rtw88: fix skb leak in hw_scan probe request length check

[Luka Gejak]

On November 14, 2026 6:06:18 PM GMT+01:00, Thadeu Lima de Souza Cascardo
<cascardo@xxxxxxxxxx> wrote:
>On Sat, Nov 14, 2026 at 02:40:24PM +0100, Luka Gejak wrote:
>> On November 13, 2026 4:17:33 PM GMT+01:00, Mauricio Faria de Oliveira
>> <mfo@xxxxxxxxxx> wrote:
>> >In _rtw_hw_scan_update_probe_req(), if the first loop fails (goto out;)
>> >the
>> >skb is leaked. It does not reach kfree_skb() at the end of the loop
>body
>> >or
>> >in the second loop (out:) since it is unlinked from probe_req_list.
>> >
>> >Fix the leak by calling kfree_skb() if the first loop fails.
>> >
>> >In /sys/kernel/debug/kmemleak, after simulating the failure:
>> >
>> >  unreferenced object 0xffff88810965a000 (size 232):
>> >    comm "iw", pid 4729, jiffies 4345008185
>> >    hex dump (first 32 bytes):
>> >      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>> >      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>> >    backtrace (crc 20f7de11):
>> >      kmem_cache_alloc_node_noprof+0x302/0x380
>> >      __alloc_skb+0x74/0x2f0
>> >      skb_copy+0x57/0xe0
>> >      rtw_hw_scan_update_probe_req+0xff/0x230
>> >      rtw_hw_scan_prehandle+0x4e/0x180
>> >      rtw_hw_scan_offload+0x186/0x1d0
>> >      rtw_ops_hw_scan+0x61/0xb0
>> >      drv_hw_scan+0x81/0x130
>> >      __ieee80211_start_scan+0x2e0/0x760
>> >      rdev_scan+0x42/0x100
>> >      nl80211_trigger_scan+0x53b/0x730
>> >      genl_family_rcv_msg_doit+0x103/0x160
>> >      genl_rcv_msg+0x1b5/0x2c0
>> >      netlink_rcv_skb+0x52/0x100
>> >      genl_rcv+0x28/0x40
>> >      netlink_unicast+0x26d/0x3b0
>> >
>> 
>> Should this dump go under --- so it doesn't end up in commit message?
>> 
>
>I find stack traces particularly helpful in commit messages. The help find
>out fixes for bugs one encounter, avoiding duplicate work, and they also
>justify the commit.
>
>Cascardo.
>

Personally I don't find it that necessary, as if I need it I will just
search the commit subject on the lore and get it from there, but I guess it
can't hurt to keep it in, so keep it if have a strong preference on that
matter.

Best regards,
Luka Gejak