]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce()
authorWillmar Knikker <willmar@met-dubbel-l.nl>
Tue, 5 May 2026 17:17:43 +0000 (17:17 +0000)
committerJeff Johnson <jeff.johnson@oss.qualcomm.com>
Mon, 18 May 2026 13:47:02 +0000 (06:47 -0700)
commit72b8654e3b83548f64524add2e9145e9b6c8a852
tree4e9da00741672c06733355336f77dae1702179fa
parent2a2451a34afdf563b3102d36a4b6cf335cf813e2
wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce()

In ath11k_dp_rx_msdu_coalesce() the loop uses ->is_continuation after
the dev_kfree_skb_any(). This can cause a use after free kfence.

Use flag for caching is_continuation for use after the
dev_kfree_skb_any().

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Willmar Knikker <willmar@met-dubbel-l.nl>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260505171709.547274-1-willmar@met-dubbel-l.nl
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
drivers/net/wireless/ath/ath11k/dp_rx.c