On 05/09/2026 at 14:15:23 +08, Xuanqiang Luo <[email protected]> wrote:
> From: Xuanqiang Luo <[email protected]> > > __ieee802154_rx_handle_packet() passes each cloned skb to > ieee802154_subif_frame() and does not release it after the call. The > callee consumes the skb on every path: it either frees it, hands it to > the networking stack, or stores it in a queued RX descriptor. > > The beacon and MAC command paths nevertheless call skb_get() before > storing the skb. The worker drops only that additional reference, leaving > the original clone reference without an owner and leaking every queued > skb. Reviewed-by: Miquel Raynal <[email protected]>
