[PATCH ath-next] wifi: ath12k: fix stale skb pointers after aligned TX payload shift

[Jeff Johnson]

On Tue, 18 Aug 2026 09:44:48 +0800, Baochen Qiang wrote:
> ath12k_wifi7_dp_tx() caches hdr, eth, and skb_cb from the skb before
> calling ath12k_dp_tx_align_payload(). That function may shift skb->data
> in place (when headroom or tailroom is sufficient) or reallocate the
> buffer entirely via skb_realloc_headroom(), freeing the original skb.
> In either case hdr, eth, and skb_cb are left pointing into stale memory.
> 
> After alignment, only hdr is refreshed, leaving eth and skb_cb stale.
> skb_cb is written immediately after (storing DMA addresses), and eth is
> re-read on every TCL ring retry via the tcl_ring_sel goto, so both
> accesses are use-after-free or stale-pointer bugs depending on which
> alignment path was taken.
> 
> [...]

Applied, thanks!

[1/1] wifi: ath12k: fix stale skb pointers after aligned TX payload shift
      commit: 6c40719489c8d799798989b15bc07b0700c132f8

Best regards,
-- 
Jeff Johnson <jeff.johnson at oss.qualcomm.com>