Re: [PATCH ath-next] wifi: ath12k: fix stale skb pointers after aligned TX payload shift
Rameshkumar Sundaram <[email protected]>
| Newsgroups | org.infradead.lists.ath12k,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <[email protected]> |
On 8/18/2026 7:14 AM, Baochen Qiang wrote:
> ath12k_wifi7_dp_tx() caches hdr, eth, and skb_cb from the skb before
> calling ath12k_dp_tx_align_payload(). That function may shift skb->data
> in place (when headroom or tailroom is sufficient) or reallocate the
> buffer entirely via skb_realloc_headroom(), freeing the original skb.
> In either case hdr, eth, and skb_cb are left pointing into stale memory.
>
> After alignment, only hdr is refreshed, leaving eth and skb_cb stale.
> skb_cb is written immediately after (storing DMA addresses), and eth is
> re-read on every TCL ring retry via the tcl_ring_sel goto, so both
> accesses are use-after-free or stale-pointer bugs depending on which
> alignment path was taken.
>
> Refresh eth (conditionally, to preserve the encap-mode distinction) and
> skb_cb alongside hdr after ath12k_dp_tx_align_payload() returns, so all
> three point into the live skb for all subsequent accesses.
>
> Issue found during code review, compile tested only.
>
> Fixes: 38055789d151 ("wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850")
> Signed-off-by: Baochen Qiang <[email protected]>
Reviewed-by: Rameshkumar Sundaram <[email protected]>