If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated skb is leaked. Free it on the error handling path. Found by Linux Verification Center (linuxtesting.org). Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link") Signed-off-by: Fedor Pchelkin --- drivers/net/wireless/realtek/rtw89/core.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 28bbc898b95e..e498c08151d5 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -3454,14 +3454,14 @@ int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rt sta = ieee80211_find_sta(vif, vif->cfg.ap_addr); if (!sta) { ret = -EINVAL; - goto out; + goto out_unlock; } rtwsta = sta_to_rtwsta(sta); skb = ieee80211_nullfunc_get(rtwdev->hw, vif, link_id, qos); if (!skb) { ret = -ENOMEM; - goto out; + goto out_unlock; } hdr = (struct ieee80211_hdr *)skb->data; @@ -3471,22 +3471,23 @@ int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rt rtwsta_link = rtwsta->links[rtwvif_link->link_id]; if (unlikely(!rtwsta_link)) { ret = -ENOLINK; - goto out; + goto out_free_skb; } ret = rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, &qsel, true, wait); if (ret) { rtw89_warn(rtwdev, "nullfunc transmit failed: %d\n", ret); - dev_kfree_skb_any(skb); - goto out; + goto out_free_skb; } rcu_read_unlock(); return rtw89_core_tx_kick_off_and_wait(rtwdev, skb, qsel, timeout); -out: +out_free_skb: + dev_kfree_skb_any(skb); +out_unlock: rcu_read_unlock(); kfree(wait); -- 2.50.1