From: Miquel Raynal <miquel.raynal@xxxxxxxxxxx> commit 621b24b09eb61c63f262da0c9c5f0e93348897e5 upstream. Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. We then leak the skb structure. Free the skb structure upon error before returning. Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") Signed-off-by: Miquel Raynal <miquel.raynal@xxxxxxxxxxx> Acked-by: Alexander Aring <aahringo@xxxxxxxxxx> Link: https://lore.kernel.org/r/20220125121426.848337-5-miquel.raynal@xxxxxxxxxxx Signed-off-by: Stefan Schmidt <stefan@xxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/ieee802154/ca8210.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -1770,6 +1770,7 @@ static int ca8210_async_xmit_complete( status ); if (status != MAC_TRANSACTION_OVERFLOW) { + dev_kfree_skb_any(priv->tx_skb); ieee802154_wake_queue(priv->hw); return 0; } Patches currently in stable-queue which might be from miquel.raynal@xxxxxxxxxxx are queue-4.14/net-ieee802154-ca8210-stop-leaking-skb-s.patch queue-4.14/net-ieee802154-return-meaningful-error-codes-from-the-netlink-helpers.patch