wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()

[ Upstream commit 5f0e4aede01cb01fa633171f0533affd25328c3a ]

In the for statement of lbs_allocate_cmd_buffer(), if the allocation of
cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to
be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().

Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240126075336.2825608-1-alexious@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c
index a4d9dd73b258866a09ed8fef67be9722e06c1c95..db9a852fa58a3474571ec30f0b9aacb87ade5cb0 100644 (file)
--- a/drivers/net/wireless/marvell/libertas/cmd.c
+++ b/drivers/net/wireless/marvell/libertas/cmd.c
@@ -1133,7 +1133,7 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv)
                if (!cmdarray[i].cmdbuf) {
                        lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n");
                        ret = -1;
-                       goto done;
+                       goto free_cmd_array;
                }
        }
 
@@ -1141,8 +1141,17 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv)
                init_waitqueue_head(&cmdarray[i].cmdwait_q);
                lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]);
        }
-       ret = 0;
+       return 0;
 
+free_cmd_array:
+       for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) {
+               if (cmdarray[i].cmdbuf) {
+                       kfree(cmdarray[i].cmdbuf);
+                       cmdarray[i].cmdbuf = NULL;
+               }
+       }
+       kfree(priv->cmd_array);
+       priv->cmd_array = NULL;
 done:
        return ret;
 }