Commit d6a2f917 authored by Bo Jiao's avatar Bo Jiao Committed by Felix Fietkau
Browse files

wifi: mt76: fix potential memory leak of beacon commands 



Fix potential memory leak when setting beacon and inband discovery
commands.

Fixes: e57b7901 ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Fixes: 98686cd2 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: default avatarBo Jiao <Bo.Jiao@mediatek.com>
Signed-off-by: default avatarShayne Chen <shayne.chen@mediatek.com>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent aad094be

drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

+8 −2
Original line number Diff line number Diff line
@@ -1927,8 +1927,10 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif, 
		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);

	}



	if (!skb)

	if (!skb) {

		dev_kfree_skb(rskb);

		return -EINVAL;

	}



	info = IEEE80211_SKB_CB(skb);

	info->control.vif = vif;
@@ -1940,6 +1942,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif, 


	if (skb->len > MT7915_MAX_BEACON_SIZE) {

		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");

		dev_kfree_skb(rskb);

		dev_kfree_skb(skb);

		return -EINVAL;

	}
@@ -1996,11 +1999,14 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 
		goto out;



	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);

	if (!skb)

	if (!skb) {

		dev_kfree_skb(rskb);

		return -EINVAL;

	}



	if (skb->len > MT7915_MAX_BEACON_SIZE) {

		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");

		dev_kfree_skb(rskb);

		dev_kfree_skb(skb);

		return -EINVAL;

	}

drivers/net/wireless/mediatek/mt76/mt7996/mcu.c

+8 −2
Original line number Diff line number Diff line
@@ -2252,11 +2252,14 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, 
		return PTR_ERR(rskb);



	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);

	if (!skb)

	if (!skb) {

		dev_kfree_skb(rskb);

		return -EINVAL;

	}



	if (skb->len > MT7996_MAX_BEACON_SIZE) {

		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");

		dev_kfree_skb(rskb);

		dev_kfree_skb(skb);

		return -EINVAL;

	}
@@ -2316,11 +2319,14 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev, 
		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);

	}



	if (!skb)

	if (!skb) {

		dev_kfree_skb(rskb);

		return -EINVAL;

	}



	if (skb->len > MT7996_MAX_BEACON_SIZE) {

		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");

		dev_kfree_skb(rskb);

		dev_kfree_skb(skb);

		return -EINVAL;

	}