wifi: iwlwifi: mvm: rfi: fix potential response leaks

[ Upstream commit 06a093807eb7b5c5b29b6cff49f8174a4e702341 ]

If the rx payload length check fails, or if kmemdup() fails,
we still need to free the command response. Fix that.

Fixes: 21254908cbe9 ("iwlwifi: mvm: add RFI-M support")
Co-authored-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240319100755.db2fa0196aa7.I116293b132502ac68a65527330fa37799694b79c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
index 1954b4cdb90b47bea159735436fbf4f72dd8a3e6..4deb242df7b37d0d388c34f9445cb5eab8ef4847 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rfi.c
@@ -104,13 +104,17 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm)
        if (ret)
                return ERR_PTR(ret);
 
-       if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size))
+       if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) !=
+                        resp_size)) {
+               iwl_free_resp(&cmd);
                return ERR_PTR(-EIO);
+       }
 
        resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL);
+       iwl_free_resp(&cmd);
+
        if (!resp)
                return ERR_PTR(-ENOMEM);
 
-       iwl_free_resp(&cmd);
        return resp;
 }