Merge: CVE-2025-38292: wifi: ath12k: fix invalid access to memory

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7121

JIRA: https://issues.redhat.com/browse/RHEL-103222
CVE: CVE-2025-38292

```
commit 9f17747
Author: Sarika Sharma <quic_sarishar@quicinc.com>
Date:   Tue Apr 8 10:23:27 2025 +0530

    wifi: ath12k: fix invalid access to memory

    In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean
    is_continuation is part of rxcb.
    Currently, after freeing the skb, the rxcb->is_continuation accessed
    again which is wrong since the memory is already freed.
    This might lead use-after-free error.

    Hence, fix by locally defining bool is_continuation from rxcb,
    so that after freeing skb, is_continuation can be used.

    Compile tested only.

    Fixes: d889913 ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
    Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
    Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
    Link: https://patch.msgid.link/20250408045327.1632222-1-quic_sarishar@quicinc.com
    Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

---

<small>Created 2025-07-11 21:30 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small>

Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com>
Approved-by: Michal Schmidt <mschmidt@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Augusto Caringi <acaringi@redhat.com>

Author: caringi

drivers/net/wireless/ath/ath12k/dp_rx.c

@@ -1823,6 +1823,7 @@ static int ath12k_dp_rx_msdu_coalesce(struct ath12k *ar,
 	struct hal_rx_desc *ldesc;
 	int space_extra, rem_len, buf_len;
 	u32 hal_rx_desc_sz = ar->ab->hal.hal_desc_sz;
+	bool is_continuation;
 
 	/* As the msdu is spread across multiple rx buffers,
 	 * find the offset to the start of msdu for computing
@@ -1871,7 +1872,8 @@ static int ath12k_dp_rx_msdu_coalesce(struct ath12k *ar,
 	rem_len = msdu_len - buf_first_len;
 	while ((skb = __skb_dequeue(msdu_list)) != NULL && rem_len > 0) {
 		rxcb = ATH12K_SKB_RXCB(skb);
-		if (rxcb->is_continuation)
+		is_continuation = rxcb->is_continuation;
+		if (is_continuation)
 			buf_len = DP_RX_BUFFER_SIZE - hal_rx_desc_sz;
 		else
 			buf_len = rem_len;
@@ -1889,7 +1891,7 @@ static int ath12k_dp_rx_msdu_coalesce(struct ath12k *ar,
 		dev_kfree_skb_any(skb);
 
 		rem_len -= buf_len;
-		if (!rxcb->is_continuation)
+		if (!is_continuation)
 			break;
 	}