[lvc-project] [PATCH rtw-next 1/6] wifi: rtw89: usb: fix leak in rtw89_usb_rx_handler()

[Ping-Ke Shih]

Fedor Pchelkin <pchelkin at ispras.ru> wrote:
> Free allocated skb on the error handling path.
> 
> Found by Linux Verification Center (linuxtesting.org).
> 
> Fixes: 2135c28be6a8 ("wifi: rtw89: Add usb.{c,h}")
> Signed-off-by: Fedor Pchelkin <pchelkin at ispras.ru>
> ---
>  drivers/net/wireless/realtek/rtw89/usb.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c
> index 6cf89aee252e..3435599f4740 100644
> --- a/drivers/net/wireless/realtek/rtw89/usb.c
> +++ b/drivers/net/wireless/realtek/rtw89/usb.c
> @@ -422,6 +422,7 @@ static void rtw89_usb_rx_handler(struct work_struct *work)
>                         rtw89_debug(rtwdev, RTW89_DBG_HCI,
>                                     "failed to allocate RX skb of size %u\n",
>                                     desc_info.pkt_size);
> +                       dev_kfree_skb_any(rx_skb);
>                         continue;
>                 }

I feel we should goto free_or_reuse like below:

free_or_reuse:
		if (skb_queue_len(&rtwusb->rx_free_queue) >= RTW89_USB_RX_SKB_NUM)
			dev_kfree_skb_any(rx_skb);
		else
			skb_queue_tail(&rtwusb->rx_free_queue, rx_skb);

If just free skb, rtwusb->rx_free_queue might be starved.