wifi: cfg80211: fix memory leak in query_regdb_file()

[ Upstream commit 69ebe5041b9cf9ae8627d504a9873fa7ec34da30 ]

In the function query_regdb_file() the alpha2 parameter is duplicated
using kmemdup() and subsequently freed in regdb_fw_cb(). However,
request_firmware_nowait() can fail without calling regdb_fw_cb() and
thus leak memory.

Fixes: 2bb24f727ff9 ("cfg80211: support loading regulatory database as firmware file")
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 74caece779633818ede05dc03226f409d06f41a1..4db397db2fb45b5e907c2d9b0f6edd3de6fac676 100644 (file)
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1060,6 +1060,8 @@ static void regdb_fw_cb(const struct firmware *fw, void *context)
 
 static int query_regdb_file(const char *alpha2)
 {
+       int err;
+
        ASSERT_RTNL();
 
        if (regdb)
@@ -1069,9 +1071,13 @@ static int query_regdb_file(const char *alpha2)
        if (!alpha2)
                return -ENOMEM;
 
-       return request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
-                                      &reg_pdev->dev, GFP_KERNEL,
-                                      (void *)alpha2, regdb_fw_cb);
+       err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
+                                     &reg_pdev->dev, GFP_KERNEL,
+                                     (void *)alpha2, regdb_fw_cb);
+       if (err)
+               kfree(alpha2);
+
+       return err;
 }
 
 int reg_reload_regdb(void)