Patch "wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()" has been added to the 6.7-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 837c0d6460e73fc5f2a6feb0b8f731e11dcc2c35
Author: Zhipeng Lu <alexious@xxxxxxxxxx>
Date:   Fri Jan 26 15:53:34 2024 +0800

    wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
    
    [ Upstream commit 5f0e4aede01cb01fa633171f0533affd25328c3a ]
    
    In the for statement of lbs_allocate_cmd_buffer(), if the allocation of
    cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to
    be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().
    
    Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver")
    Signed-off-by: Zhipeng Lu <alexious@xxxxxxxxxx>
    Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxx>
    Link: https://msgid.link/20240126075336.2825608-1-alexious@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c
index 104d2b6dc9af6..5a525da434c28 100644
--- a/drivers/net/wireless/marvell/libertas/cmd.c
+++ b/drivers/net/wireless/marvell/libertas/cmd.c
@@ -1132,7 +1132,7 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv)
 		if (!cmdarray[i].cmdbuf) {
 			lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n");
 			ret = -1;
-			goto done;
+			goto free_cmd_array;
 		}
 	}
 
@@ -1140,8 +1140,17 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv)
 		init_waitqueue_head(&cmdarray[i].cmdwait_q);
 		lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]);
 	}
-	ret = 0;
+	return 0;
 
+free_cmd_array:
+	for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) {
+		if (cmdarray[i].cmdbuf) {
+			kfree(cmdarray[i].cmdbuf);
+			cmdarray[i].cmdbuf = NULL;
+		}
+	}
+	kfree(priv->cmd_array);
+	priv->cmd_array = NULL;
 done:
 	return ret;
 }