This code is trying to clone the skb with optional skb->sk. But this
will fail to clone the skb if socket was closed just after the skb was
pushed into the networking stack.

Fixes: a7528198add8 ("mac80211: support control port TX status reporting")
Signed-off-by: Oleksij Rempel <o.rem...@pengutronix.de>
---
 net/mac80211/tx.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5d06de61047a..c0dd326db10d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2439,11 +2439,7 @@ static u16 ieee80211_store_ack_skb(struct 
ieee80211_local *local,
        struct sk_buff *ack_skb;
        u16 info_id = 0;
 
-       if (skb->sk)
-               ack_skb = skb_clone_sk(skb);
-       else
-               ack_skb = skb_clone(skb, GFP_ATOMIC);
-
+       ack_skb = skb_clone_sk_optional(skb);
        if (ack_skb) {
                unsigned long flags;
                int id;
-- 
2.29.2

Reply via email to