openwrt-mirror/openwrt
1
0 Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2026-10-14 06:38:29 +04:00
Code Issues Packages Projects Releases Wiki Activity

mac80211_hwsim: free a frame whose rate is wider than the channel

Browse Source 
The path that warns about such a frame returned without freeing it.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau committed 2026-10-08 09:50:38 +02:00
1 parent b66365b233
commit 6343a98608
1 file changed
+29
Download Patch File Download Diff File Expand all files Collapse all files
package/kernel/mac80211/patches/subsys/420-wifi-mac80211_hwsim-free-a-frame-whose-rate-is-wider-than-the-channel.patch
+29
View File
@@ -0,0 +1,29 @@
From: Felix Fietkau <nbd@nbd.name>
Date: Thu, 1 Oct 2026 22:24:19 +0200
Subject: [PATCH] wifi: mac80211_hwsim: free a frame whose rate is wider than
the channel
mac80211_hwsim_tx() warns and returns when a rate of the frame is wider
than the channel width in use, but does not free the frame, so it leaks
the skb and the frame never gets a TX status. Free it as the other drop
paths of the function do.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -2457,8 +2457,10 @@ static void mac80211_hwsim_tx(struct iee
else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
bw = NL80211_CHAN_WIDTH_160;
- if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
+ if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw))) {
+ ieee80211_free_txskb(hw, skb);
return;
+ }
}
if (tx_link_sta && control->sta->valid_links)