wifi: iwlwifi: mvm: rfi: fix potential response leaks

If the rx payload length check fails, or if kmemdup() fails,
we still need to free the command response. Fix that.

Fixes: 21254908cbe9 ("iwlwifi: mvm: add RFI-M support")
Co-authored-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240319100755.db2fa0196aa7.I116293b132502ac68a65527330fa37799694b79c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
index 2ecd32bed752ff55734d5e9f78f36efc213cb107..045c862a8fc4fc66c0e5c6cfa8333ae4fb968f28 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
@@ -132,14 +132,18 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm)
        if (ret)
                return ERR_PTR(ret);
 
-       if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size))
+       if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) !=
+                        resp_size)) {
+               iwl_free_resp(&cmd);
                return ERR_PTR(-EIO);
+       }
 
        resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL);
+       iwl_free_resp(&cmd);
+
        if (!resp)
                return ERR_PTR(-ENOMEM);
 
-       iwl_free_resp(&cmd);
        return resp;
 }