iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wifi: iwlwifi: mvm: rfi: fix potential response leaks

Browse Source 
[ Upstream commit 06a093807eb7b5c5b29b6cff49f8174a4e702341 ]

If the rx payload length check fails, or if kmemdup() fails,
we still need to free the command response. Fix that.

Fixes: 21254908cbe9 ("iwlwifi: mvm: add RFI-M support")
Co-authored-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240319100755.db2fa0196aa7.I116293b132502ac68a65527330fa37799694b79c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Johannes Berg 2024-03-19 10:10:17 +02:00 committed by Greg Kroah-Hartman
parent 254f1c2521
commit 28db0ae86c
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
View File

@ -104,13 +104,17 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm)
if (ret)
return ERR_PTR(ret);
if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size))
if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) !=
resp_size)) {
iwl_free_resp(&cmd);
return ERR_PTR(-EIO);
}
resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL);
iwl_free_resp(&cmd);
if (!resp)
return ERR_PTR(-ENOMEM);
iwl_free_resp(&cmd);
return resp;
}