releases/6.6.26/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch

   1 From cbfe17ae330c50e9f4cc28168fb787404cf3d65f Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Tue, 19 Mar 2024 10:10:17 +0200
   4 Subject: wifi: iwlwifi: mvm: rfi: fix potential response leaks
   5
   6 From: Johannes Berg <johannes.berg@intel.com>
   7
   8 [ Upstream commit 06a093807eb7b5c5b29b6cff49f8174a4e702341 ]
   9
  10 If the rx payload length check fails, or if kmemdup() fails,
  11 we still need to free the command response. Fix that.
  12
  13 Fixes: 21254908cbe9 ("iwlwifi: mvm: add RFI-M support")
  14 Co-authored-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
  15 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  16 Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
  17 Link: https://msgid.link/20240319100755.db2fa0196aa7.I116293b132502ac68a65527330fa37799694b79c@changeid
  18 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  19 Signed-off-by: Sasha Levin <sashal@kernel.org>
  20 ---
  21  drivers/net/wireless/intel/iwlwifi/mvm/rfi.c | 8 ++++++--
  22  1 file changed, 6 insertions(+), 2 deletions(-)
  23
  24 diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
  25 index 2ecd32bed752f..045c862a8fc4f 100644
  26 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
  27 +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
  28 @@ -132,14 +132,18 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm)
  29         if (ret)
  30                 return ERR_PTR(ret);
  31
  32 -       if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size))
  33 +       if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) !=
  34 +                        resp_size)) {
  35 +               iwl_free_resp(&cmd);
  36                 return ERR_PTR(-EIO);
  37 +       }
  38
  39         resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL);
  40 +       iwl_free_resp(&cmd);
  41 +
  42         if (!resp)
  43                 return ERR_PTR(-ENOMEM);
  44
  45 -       iwl_free_resp(&cmd);
  46         return resp;
  47  }
  48
  49 --
  50 2.43.0
  51