wifi: mt76: fix potential memory leak of beacon commands

[ Upstream commit d6a2f91741d9f43b31cb16c82da37f35117a6d1c ]

Fix potential memory leak when setting beacon and inband discovery
commands.

Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 5cf45c5..44d5aad 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -1925,8 +1925,10 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
                skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
        }
 
-       if (!skb)
+       if (!skb) {
+               dev_kfree_skb(rskb);
                return -EINVAL;
+       }
 
        info = IEEE80211_SKB_CB(skb);
        info->control.vif = vif;
@@ -1938,6 +1940,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
 
        if (skb->len > MT7915_MAX_BEACON_SIZE) {
                dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
+               dev_kfree_skb(rskb);
                dev_kfree_skb(skb);
                return -EINVAL;
        }
@@ -1994,11 +1997,14 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                goto out;
 
        skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
-       if (!skb)
+       if (!skb) {
+               dev_kfree_skb(rskb);
                return -EINVAL;
+       }
 
        if (skb->len > MT7915_MAX_BEACON_SIZE) {
                dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
+               dev_kfree_skb(rskb);
                dev_kfree_skb(skb);
                return -EINVAL;
        }

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 44a7c5a..f454534 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -2042,11 +2042,14 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
                return PTR_ERR(rskb);
 
        skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
-       if (!skb)
+       if (!skb) {
+               dev_kfree_skb(rskb);
                return -EINVAL;
+       }
 
        if (skb->len > MT7996_MAX_BEACON_SIZE) {
                dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
+               dev_kfree_skb(rskb);
                dev_kfree_skb(skb);
                return -EINVAL;
        }
@@ -2106,11 +2109,14 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
                skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
        }
 
-       if (!skb)
+       if (!skb) {
+               dev_kfree_skb(rskb);
                return -EINVAL;
+       }
 
        if (skb->len > MT7996_MAX_BEACON_SIZE) {
                dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
+               dev_kfree_skb(rskb);
                dev_kfree_skb(skb);
                return -EINVAL;
        }