brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach

[ Upstream commit 6c151410d5b57e6bb0d91a735ac511459539a7bf ]

When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
we should destroy the workqueue.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1595237765-66238-1-git-send-email-wangyufen@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index f944f356d9c51327f2f6f3c839440cd944a4ae9c..cacb43573f5790c4ac06063fb0c3425748b491ff 100644 (file)
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -1530,6 +1530,8 @@ fail:
                                          BRCMF_TX_IOCTL_MAX_MSG_SIZE,
                                          msgbuf->ioctbuf,
                                          msgbuf->ioctbuf_handle);
+               if (msgbuf->txflow_wq)
+                       destroy_workqueue(msgbuf->txflow_wq);
                kfree(msgbuf);
        }
        return -ENOMEM;