Commit 06a09380 authored by Johannes Berg's avatar Johannes Berg
Browse files

wifi: iwlwifi: mvm: rfi: fix potential response leaks 



If the rx payload length check fails, or if kmemdup() fails,
we still need to free the command response. Fix that.

Fixes: 21254908 ("iwlwifi: mvm: add RFI-M support")
Co-authored-by: default avatarAnjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240319100755.db2fa0196aa7.I116293b132502ac68a65527330fa37799694b79c@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 134d715e

drivers/net/wireless/intel/iwlwifi/mvm/rfi.c

+6 −2
Original line number Diff line number Diff line
@@ -132,14 +132,18 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm) 
	if (ret)

		return ERR_PTR(ret);



	if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size))

	if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) !=

			 resp_size)) {

		iwl_free_resp(&cmd);

		return ERR_PTR(-EIO);

	}



	resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL);

	iwl_free_resp(&cmd);



	if (!resp)

		return ERR_PTR(-ENOMEM);



	iwl_free_resp(&cmd);

	return resp;

}