Re: [PATCH v1] wifi: mt76: mt792x: fix memory leak in USB TX path

On Sun, 2026-08-16 at 18:41 -0700, Devin Wittmayer wrote:
> 
> mt76_skb_adjust_pad() calls skb_pad(), which frees the skb on
> failure, and
> today mt76u_tx_queue_skb() correctly returns without touching it.
> Routing that
> exit to err_free_skb: frees it a second time. Special casing does not
> help,
> since skb_cow_head() on the same exit also returns -ENOMEM and is
> safe.
> 
> The prerequisite, in mt76_skb_adjust_pad():
> 
>         -       if (skb_pad(last, pad))
>         +       if (__skb_pad(last, pad, false))
> 
> It reaches mt7925 and SDIO too, so probably its own patch ahead of
> yours.
> 

I have submitted another commit to address the UAF issue in
mt76_skb_adjust_pad()
https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/

> Worth flagging as well: mt76s_tx_queue_skb is not a model here, it
> has the same
> two exits and the same missing free.
> 
> I have mt7921u here if you want a v2 tested.
> 
> Devin

If you have time, please help test the v2 on mt7921u.
https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/

Thanks,
Eason