mt76: mt76x02: fix SKB memory leak on error path in USB MCU
PATCH 1/1 mt76: mt76x02: fix SKB memory leak on error path in USB MCU
Patch Attached!
Signature · 2 lines
Secured with Tuta Mail: https://tuta.com/free-email
From: VolcomIlluminated <[email protected]>
Date: Wed, 28 May 2026 00:00:00 +0000
Subject: [PATCH] mt76: mt76x02: fix SKB memory leak on error path in USB MCU
When mt76x02u_skb_dma_info() fails, the function returns immediately without calling consume_skb(), leaking the SKB allocation.
Replace the early return with a goto to the existing out label which calls consume_skb() unconditionally.
This addresses CVE-2022-50172.
Tested on Netgear A6210 (MT76x2U) with 1,640 packets and zero drops over 2+ hours of continuous operation.
Signed-off-by VolcomIlluminated <[email protected]>
---
home/ptpx86mm1/kernelbuild/linux-6.18/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c renamed from tmp/linux-6.18/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c +1 -1
@@ -90,7 +90,7 @@MT_MCU_MSG_TYPE_CMD ; ret =mt76x02u_skb_dma_info (skb,CPU_TX_PORT , info);if (ret) -return ret; + goto out; ret =mt76u_bulk_msg (dev, skb->data, skb->len,NULL ,500 ,MT_EP_OUT_INBAND_CMD );