wifi: nxpwifi: free the aggregation buffer when the RA list disappears

Browse source

nxpwifi_11n_aggregate_pkt() drops ra_list_spinlock while it copies each
subframe, so it rechecks the RA list after taking the lock again.  The
check inside the aggregation loop returns without releasing the
skb_aggr it has been filling, leaking one tx_buf_size buffer along with
the subframes already aggregated into it.

Release skb_aggr there, the way the same check on the -EBUSY path
already does.

mwifiex fixed the same issue in commit 990a73dec3 ("wifi: mwifiex: Fix
memory leak in mwifiex_11n_aggregate_pkt()").

Fixes: 73b01e57ed ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>

...

This commit is contained in:

Linmao Li 2026-08-13 16:23:14 +08:00 • committed by Jeff Chen

parent 5c9260d7c6

commit d68d6d8d8b

1 changed files with 1 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

drivers/net/wireless/nxp/nxpwifi/11n_aggr.c

View file