[PATCH v1] wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory
Eason Lai <[email protected]>
| Newsgroups | org.infradead.lists.linux-mediatek,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <[email protected]> |
Using __skb_pad() instead of skb_pad() in mt76_skb_adjust_pad()
to prevent double-free, as the caller handles cleanup.
Fixes: 808f2767d421 ("wifi: mt76: mt792x: Fix memory leak in SDIO TX path")
Co-developed-by: Devin Wittmayer <[email protected]>
Signed-off-by: Eason Lai <[email protected]>
---
drivers/net/wireless/mediatek/mt76/tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 3707ee19e4ae..ec503521ae63 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -879,7 +879,7 @@ int mt76_skb_adjust_pad(struct sk_buff *skb, int pad)
}
}
- if (skb_pad(last, pad))
+ if (__skb_pad(last, pad, false))
return -ENOMEM;
__skb_put(last, pad);
--
2.45.2