nl80211: Fix memory leak on nla_put_failure error paths

Signed-hostap: Jason Young <jason.young@dspg.com>

src/drivers/driver_nl80211.c

@@ -1635,6 +1635,7 @@ static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
 
 	return send_and_recv_msgs(drv, msg, get_link_signal, sig);
  nla_put_failure:
+	nlmsg_free(msg);
 	return -ENOBUFS;
 }
 
@@ -1701,6 +1702,7 @@ static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
 
 	return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
  nla_put_failure:
+	nlmsg_free(msg);
 	return -ENOBUFS;
 }
 
@@ -2254,6 +2256,7 @@ static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
 		return -EINVAL;
 	return 0;
 nla_put_failure:
+	nlmsg_free(msg);
 	return -EINVAL;
 }
 
@@ -3182,6 +3185,7 @@ static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
 
 	return send_and_recv_msgs(drv, msg, NULL, NULL);
  nla_put_failure:
+	nlmsg_free(msg);
 	return -ENOBUFS;
 }
 
@@ -4093,6 +4097,7 @@ static int wpa_driver_nl80211_set_key(const char *ifname, void *priv,
 	return ret;
 
 nla_put_failure:
+	nlmsg_free(msg);
 	return -ENOBUFS;
 }
 
@@ -4961,7 +4966,9 @@ wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
 		nl80211_set_ht40_flags(drv, &result);
 		return wpa_driver_nl80211_add_11b(result.modes, num_modes);
 	}
+	msg = NULL;
  nla_put_failure:
+	nlmsg_free(msg);
 	return NULL;
 }
 
@@ -5129,6 +5136,7 @@ static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
 
 	return send_and_recv_msgs(drv, msg, NULL, NULL);
  nla_put_failure:
+	nlmsg_free(msg);
 	return -ENOBUFS;
 }
 
@@ -5277,6 +5285,7 @@ static int wpa_driver_nl80211_set_ap(void *priv,
 	}
 	return ret;
  nla_put_failure:
+	nlmsg_free(msg);
 	return -ENOBUFS;
 }
 
@@ -5318,6 +5327,7 @@ static int wpa_driver_nl80211_set_freq(struct i802_bss *bss,
 	}
 
 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+	msg = NULL;
 	if (ret == 0) {
 		bss->freq = freq;
 		return 0;
@@ -5325,6 +5335,7 @@ static int wpa_driver_nl80211_set_freq(struct i802_bss *bss,
 	wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
 		   "%d (%s)", freq, ret, strerror(-ret));
 nla_put_failure:
+	nlmsg_free(msg);
 	return -1;
 }
 
@@ -5403,6 +5414,7 @@ static int wpa_driver_nl80211_sta_add(void *priv,
 	}
 
 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+	msg = NULL;
 	if (ret)
 		wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
 			   "result: %d (%s)", params->set ? "SET" : "NEW", ret,
@@ -5412,6 +5424,7 @@ static int wpa_driver_nl80211_sta_add(void *priv,
  nla_put_failure:
 	if (wme)
 		nlmsg_free(wme);
+	nlmsg_free(msg);
 	return ret;
 }
 
@@ -5438,6 +5451,7 @@ static int wpa_driver_nl80211_sta_remove(void *priv, const u8 *addr)
 		return 0;
 	return ret;
  nla_put_failure:
+	nlmsg_free(msg);
 	return -ENOBUFS;
 }
 
@@ -5461,7 +5475,9 @@ static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
 
 	if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
 		return;
+	msg = NULL;
  nla_put_failure:
+	nlmsg_free(msg);
 	wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
 }
 
@@ -5528,8 +5544,10 @@ static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
 	}
 
 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+	msg = NULL;
 	if (ret) {
  nla_put_failure:
+		nlmsg_free(msg);
 		wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
 			   ifname, ret, strerror(-ret));
 		return ret;
@@ -6180,6 +6198,7 @@ static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
 
 	return send_and_recv_msgs(drv, msg, NULL, NULL);
  nla_put_failure:
+	nlmsg_free(msg);
 	nlmsg_free(flags);
 	return -ENOBUFS;
 }
@@ -6684,9 +6703,11 @@ static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
 	NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
 
 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+	msg = NULL;
 	if (!ret)
 		return 0;
 nla_put_failure:
+	nlmsg_free(msg);
 	wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
 		   " %d (%s)", ifindex, mode, ret, strerror(-ret));
 	return ret;
@@ -6833,6 +6854,7 @@ static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
 
 	return send_and_recv_msgs(drv, msg, NULL, NULL);
  nla_put_failure:
+	nlmsg_free(msg);
 	return -ENOBUFS;
 }
 
@@ -6925,9 +6947,11 @@ static int i802_set_rts(void *priv, int rts)
 	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
 
 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+	msg = NULL;
 	if (!ret)
 		return 0;
 nla_put_failure:
+	nlmsg_free(msg);
 	wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
 		   "%d (%s)", rts, ret, strerror(-ret));
 	return ret;
@@ -6956,9 +6980,11 @@ static int i802_set_frag(void *priv, int frag)
 	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
 
 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+	msg = NULL;
 	if (!ret)
 		return 0;
 nla_put_failure:
+	nlmsg_free(msg);
 	wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
 		   "%d: %d (%s)", frag, ret, strerror(-ret));
 	return ret;
@@ -7862,6 +7888,7 @@ static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
 
 	cookie = 0;
 	ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
+	msg = NULL;
 	if (ret == 0) {
 		wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
 			   "0x%llx for freq=%u MHz duration=%u",
@@ -7874,6 +7901,7 @@ static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
 		   "(freq=%d duration=%u): %d (%s)",
 		   freq, duration, ret, strerror(-ret));
 nla_put_failure:
+	nlmsg_free(msg);
 	return -1;
 }
 
@@ -7905,11 +7933,13 @@ static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
 	NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
 
 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+	msg = NULL;
 	if (ret == 0)
 		return 0;
 	wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
 		   "%d (%s)", ret, strerror(-ret));
 nla_put_failure:
+	nlmsg_free(msg);
 	return -1;
 }
 
@@ -8104,8 +8134,7 @@ static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
 	msg = NULL;
 
 nla_put_failure:
-	if (cqm)
+	nlmsg_free(cqm);
-		nlmsg_free(cqm);
 	nlmsg_free(msg);
 	return -1;
 }