wifi: mac80211: fix memory leak in ieee80211_register_hw()

If kmemdup() fails while copying supported band structures, the error
path jumps to fail_rate. This skips rate_control_deinitialize() and
leaks the initialized local->rate_ctrl.

Fix this by adding a fail_band label that shares the rate-control cleanup
path before falling through to the remaining teardown.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still present in
v7.1-rc7.

An x86_64 allyesconfig build showed no new warnings. As we do not have a
suitable mac80211 device/driver combination to test with, no runtime
testing was able to be performed.

Fixes: 09b4a4faf9d0 ("mac80211: introduce capability flags for VHT EXT NSS support")
Cc: stable@vger.kernel.org
Reviewed-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Link: https://patch.msgid.link/20260706143507.146131-1-dawei.feng@seu.edu.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 90d295cc364fb3d5839753b5e2c1112970de0330..eb1eaaf34612e1d7405c80fe8f312fc69a4e41bd 100644 (file)
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1602,7 +1602,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                sband = kmemdup(sband, sizeof(*sband), GFP_KERNEL);
                if (!sband) {
                        result = -ENOMEM;
-                       goto fail_rate;
+                       goto fail_band;
                }
 
                wiphy_dbg(hw->wiphy, "copying sband (band %d) due to VHT EXT NSS BW flag\n",
@@ -1678,6 +1678,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 #endif
        wiphy_unregister(local->hw.wiphy);
  fail_wiphy_register:
+ fail_band:
        rtnl_lock();
        rate_control_deinitialize(local);
        ieee80211_remove_interfaces(local);