mt76: mt7615: fix possible memory leak in mt7615_mcu_wtbl_sta_add

[ Upstream commit 2bccc8415883c1cd5ae8836548d9783dbbd84999 ]

Free the second mcu skb if __mt76_mcu_skb_send_msg() fails to transmit
the first one in mt7615_mcu_wtbl_sta_add().

Fixes: 99c457d902cf9 ("mt76: mt7615: move mt7615_mcu_set_bmc to mt7615_mcu_ops")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
index 9c55424962522547d570ad031515dbe3cb3205a7..81d6127dc6fd89ff697f8ae5bfcd0550780dafb4 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
@@ -1036,8 +1036,12 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
        skb = enable ? wskb : sskb;
 
        err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
-       if (err < 0)
+       if (err < 0) {
+               skb = enable ? sskb : wskb;
+               dev_kfree_skb(skb);
+
                return err;
+       }
 
        cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
        skb = enable ? sskb : wskb;