From 0ba1b366185b770440bf4eee3c4a929bc3cfc0e9 Mon Sep 17 00:00:00 2001 From: Ben Greear Date: Sat, 14 Feb 2026 11:05:09 -0800 Subject: [PATCH] wifi: iwlwifi: Clean dangling pointer in tx path If iwl_txq_gen2_build_tfd fails, we return -1, which will cause calling code to dispose of the skb one way or another. Remove any reference to that skb from the txq entries so that nothing will try to access it later. Signed-off-by: Ben Greear Link: https://patch.msgid.link/20260214190509.2098565-1-greearb@candelatech.com Signed-off-by: Miri Korenblit --- drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx-gen2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx-gen2.c index bda9f807321e..27f4973791d0 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx-gen2.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx-gen2.c @@ -773,6 +773,8 @@ int iwl_txq_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb, tfd = iwl_txq_gen2_build_tfd(trans, txq, dev_cmd, skb, out_meta); if (!tfd) { + txq->entries[idx].skb = NULL; + txq->entries[idx].cmd = NULL; spin_unlock(&txq->lock); return -1; }