cfg80211: release station info tidstats where needed

This fixes memory leaks in cases where we got the station
info but failed sending it out properly.

Fixes: 8689c051a201 ("cfg80211: dynamically allocate per-tid stats for station info")
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 8 insertions, 3 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7daceb1f253d..e4a52a2b5e65 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4702,7 +4702,6 @@ static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
                 }
 
                 nla_nest_end(msg, tidsattr);
-                kfree(sinfo->pertid);
         }
 
         nla_nest_end(msg, sinfoattr);
@@ -4712,10 +4711,12 @@ static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
                     sinfo->assoc_req_ies))
                 goto nla_put_failure;
 
+        cfg80211_sinfo_release_content(sinfo);
         genlmsg_end(msg, hdr);
         return 0;
 
  nla_put_failure:
+        cfg80211_sinfo_release_content(sinfo);
         genlmsg_cancel(msg, hdr);
         return -EMSGSIZE;
 }
@@ -4797,8 +4798,10 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
                 return err;
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg)
+        if (!msg) {
+                cfg80211_sinfo_release_content(sinfo);
                 return -ENOMEM;
+        }
 
         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
                                  info->snd_portid, info->snd_seq, 0,
@@ -14624,8 +14627,10 @@ void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
         trace_cfg80211_del_sta(dev, mac_addr);
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
-        if (!msg)
+        if (!msg) {
+                cfg80211_sinfo_release_content(sinfo);
                 return;
+        }
 
         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
                                  rdev, dev, mac_addr, sinfo) < 0) {