diff options
| author | Fedor Pchelkin <pchelkin@ispras.ru> | 2025-09-20 00:08:49 +0300 |
|---|---|---|
| committer | Ping-Ke Shih <pkshih@realtek.com> | 2025-09-22 13:58:52 +0800 |
| commit | a9f0064f4716b0fd97085015ea1dd398bdfdc946 (patch) | |
| tree | 7b339c4e2b30e7a2bfeef52832e7275d8b33f15d | |
| parent | c24248ed78f33ea299ea61d105355ba47157d49f (diff) | |
wifi: rtw89: fix leak in rtw89_core_send_nullfunc()
If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated
skb is leaked. Free it on the error handling path.
Found by Linux Verification Center (linuxtesting.org).
Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250919210852.823912-4-pchelkin@ispras.ru
| -rw-r--r-- | drivers/net/wireless/realtek/rtw89/core.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 1f44c7fc1c5e..917b2adede61 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -3961,6 +3961,7 @@ int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rt rtwsta_link = rtwsta->links[rtwvif_link->link_id]; if (unlikely(!rtwsta_link)) { ret = -ENOLINK; + dev_kfree_skb_any(skb); goto out; } |