cfg80211: Fix memory leak

When a driver requests a specific regulatory domain after cfg80211 already
has one, a struct ieee80211_regdomain is leaked.

Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 7 insertions, 2 deletions

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 6ea626b30a2a..08d3da2c70ab 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2189,10 +2189,15 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                  * However if a driver requested this specific regulatory
                  * domain we keep it for its private use
                  */
-                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER)
+                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER) {
+                        const struct ieee80211_regdomain *tmp;
+
+                        tmp = get_wiphy_regdom(request_wiphy);
                         rcu_assign_pointer(request_wiphy->regd, rd);
-                else
+                        rcu_free_regdom(tmp);
+                } else {
                         kfree(rd);
+                }
 
                 rd = NULL;