wifi: rtw89: usb: fix leak in rtw89_usb_write_port()

[ Upstream commit 7543818e97d5d54b3b2f75f1c4dedee298d7d914 ]

When there is an attempt to write data and RTW89_FLAG_UNPLUGGED is set,
this means device is disconnected and no urb is submitted.  Return
appropriate error code to the caller to properly free the allocated
resources.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 2135c28be6a8 ("wifi: rtw89: Add usb.{c,h}")
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251104135720.321110-3-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c
index e8e064cf7e0ad9244c3413d6069ab76f5f5925a7..512a46dd9d06a361bcbb603f25257598978406ff 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/usb.c
+++ b/drivers/net/wireless/realtek/rtw89/usb.c
@@ -256,7 +256,7 @@ static int rtw89_usb_write_port(struct rtw89_dev *rtwdev, u8 ch_dma,
        int ret;
 
        if (test_bit(RTW89_FLAG_UNPLUGGED, rtwdev->flags))
-               return 0;
+               return -ENODEV;
 
        urb = usb_alloc_urb(0, GFP_ATOMIC);
        if (!urb)
@@ -305,8 +305,9 @@ static void rtw89_usb_ops_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch)
                ret = rtw89_usb_write_port(rtwdev, txch, skb->data, skb->len,
                                           txcb);
                if (ret) {
-                       rtw89_err(rtwdev, "write port txch %d failed: %d\n",
-                                 txch, ret);
+                       if (ret != -ENODEV)
+                               rtw89_err(rtwdev, "write port txch %d failed: %d\n",
+                                         txch, ret);
 
                        skb_dequeue(&txcb->tx_ack_queue);
                        kfree(txcb);