wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()

Commit Message

Ping-Ke Shih Jan. 3, 2023, 2:10 p.m. UTC

From: Zong-Zhe Yang <[e-mail]>

Do `kfree_skb(new)` before `goto out` to prevent potential leak.

Fixes: 895907779752 ("rtw89: 8852a: add ieee80211_ops::hw_scan")
Signed-off-by: Zong-Zhe Yang <[e-mail]>
Signed-off-by: Ping-Ke Shih <[e-mail]>
---
 drivers/net/wireless/realtek/rtw89/fw.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Kalle Valo Jan. 16, 2023, 1:35 p.m. UTC | #1

Ping-Ke Shih <[e-mail]> wrote:

> From: Zong-Zhe Yang <[e-mail]>
> 
> Do `kfree_skb(new)` before `goto out` to prevent potential leak.
> 
> Fixes: 895907779752 ("rtw89: 8852a: add ieee80211_ops::hw_scan")
> Signed-off-by: Zong-Zhe Yang <[e-mail]>
> Signed-off-by: Ping-Ke Shih <[e-mail]>

Patch applied to wireless-next.git, thanks.

4a0e218cc9c4 wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()

Patch

diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 0328874a0d10e..466d8273bc2b1 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -2676,8 +2676,10 @@  static int rtw89_append_probe_req_ie(struct rtw89_dev *rtwdev,
 
 		list_add_tail(&info->list, &scan_info->pkt_list[band]);
 		ret = rtw89_fw_h2c_add_pkt_offload(rtwdev, &info->id, new);
-		if (ret)
+		if (ret) {
+			kfree_skb(new);
 			goto out;
+		}
 
 		kfree_skb(new);
 	}