When the TKIP MSDU encryption is done in software (host_encrypt_msdu, set by ipw2200), libipw_xmit() copies the frame into a new skb, frees the original skb and goes on with the new one. If libipw_alloc_txb() then fails, the function jumps to "failed" and returns NETDEV_TX_BUSY. The core stack takes NETDEV_TX_BUSY as "skb not consumed" and requeues the original skb, which has already been freed, so it is used after free. The new skb is leaked. Even without the swap, returning NETDEV_TX_BUSY from "failed" is wrong: every jump there comes after skb_pull() removed the Ethernet header, so a requeued skb is sent again without it. Drop the frame on these errors instead: free the skb and return NETDEV_TX_OK. Do not stop the queue either, since no frame is waiting for it to be woken. Fixes: 1264fc0498e1 ("[PATCH] ieee80211: Fix TKIP, repeated fragmentation problem, and payload_size reporting") Cc: stable@vger.kernel.org Signed-off-by: Yuqiang Sun --- Notes: The bug was found with kbound, a research static analysis prototype. The patch and the changelog were written with the help of an AI coding assistant (Claude); I have reviewed them. Compile-tested only (x86_64 and arm64 allmodconfig, W=1, sparse): I do not have ipw2100/ipw2200 hardware, and there is no emulated device. drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c index 6e16060834b8..d0352c8dc064 100644 --- a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c +++ b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c @@ -509,9 +509,9 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev) failed: spin_unlock_irqrestore(&ieee->lock, flags); - netif_stop_queue(dev); + dev_kfree_skb_any(skb); dev->stats.tx_errors++; - return NETDEV_TX_BUSY; + return NETDEV_TX_OK; } EXPORT_SYMBOL(libipw_xmit); base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4 -- 2.53.0