gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()

Browse Source 
mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to
be freed eventually by mt76_mcu_skb_send_msg(). However, currently if
an intermediate function fails before sending, the allocated skb is
leaked.

Specifically, mt76_connac_mcu_sta_wed_update() and
mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory
leak in the error path.

Fix this by explicitly freeing the skb in these error paths.
Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on
mt7996_mcu_sta_key_tlv error") made a similar change.

Compile tested only. Issue found using a prototype static analysis tool
and code review.

Fixes: d1369e515efe ("wifi: mt76: connac: introduce mt76_connac_mcu_sta_wed_update utility routine")
Fixes: 6683d988089c ("mt76: connac: move mt76_connac_mcu_add_key in connac module")
Fixes: 4f831d18d12d ("wifi: mt76: mt7915: enable WED RX support")
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Zilin Guan <[email protected]>
Link: https://patch.msgid.link/[email protected]
This commit is contained in:
Zilin Guan
2026-01-27 12:09:04 +00:00
committed by Felix Fietkau
parent f5b57ffab5
commit 7ab500f7db
3 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt76_connac_mcu.c
+12 -4
View File
@@ -1295,8 +1295,10 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,
wtbl_hdr);
ret = mt76_connac_mcu_sta_wed_update(dev, skb);
if (ret)
if (ret) {
dev_kfree_skb(skb);
return ret;
}
ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
if (ret)
@@ -1309,8 +1311,10 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,
mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
ret = mt76_connac_mcu_sta_wed_update(dev, skb);
if (ret)
if (ret) {
dev_kfree_skb(skb);
return ret;
}
return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
}
@@ -2764,12 +2768,16 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
return PTR_ERR(skb);
ret = mt76_connac_mcu_sta_key_tlv(sta_key_conf, skb, key, cmd);
if (ret)
if (ret) {
dev_kfree_skb(skb);
return ret;
}
ret = mt76_connac_mcu_sta_wed_update(dev, skb);
if (ret)
if (ret) {
dev_kfree_skb(skb);
return ret;
}
return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
}
mt7915/mcu.c
+3 -1
View File
@@ -1770,8 +1770,10 @@ int __mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
}
out:
ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
if (ret)
if (ret) {
dev_kfree_skb(skb);
return ret;
}
return mt76_mcu_skb_send_msg(&dev->mt76, skb,
MCU_EXT_CMD(STA_REC_UPDATE), true);
mt7925/mcu.c
+3 -1
View File
@@ -1288,8 +1288,10 @@ int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
return PTR_ERR(skb);
ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
if (ret)
if (ret) {
dev_kfree_skb(skb);
return ret;
}
return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
}