git: 8a4d4ffde5e2 - stable/13 - rtw88: plug various skb leaks in error cases

The branch stable/13 has been updated by bz:

URL: https://cgit.FreeBSD.org/src/commit/?id=8a4d4ffde5e2ec8b3eef9a8118711640c6c2547a

commit 8a4d4ffde5e2ec8b3eef9a8118711640c6c2547a
Author:     Bjoern A. Zeeb <bz@FreeBSD.org>
AuthorDate: 2022-06-05 18:07:48 +0000
Commit:     Bjoern A. Zeeb <bz@FreeBSD.org>
CommitDate: 2022-06-08 16:11:19 +0000

    rtw88: plug various skb leaks in error cases
    
    Based on manual inspection the skbs are not freed in those unlikely
    cases, though all would give an error message so would have gone noticed
    if happened.
    While here fix a typo in one of these error messages.
    
    (cherry picked from commit 728afa885f04f6316bc9ecf6498f4a635ced1e21)
---
 sys/contrib/dev/rtw88/fw.c  | 3 +++
 sys/contrib/dev/rtw88/pci.c | 6 ++++++
 sys/contrib/dev/rtw88/tx.c  | 5 +++++
 3 files changed, 14 insertions(+)

diff --git a/sys/contrib/dev/rtw88/fw.c b/sys/contrib/dev/rtw88/fw.c
index 2f7c036f9022..e1837ea6a13c 100644
--- a/sys/contrib/dev/rtw88/fw.c
+++ b/sys/contrib/dev/rtw88/fw.c
@@ -1825,6 +1825,9 @@ static int _rtw_hw_scan_update_probe_req(struct rtw_dev *rtwdev, u8 num_ssids,
 		skb_unlink(skb, probe_req_list);
 		rtw_fill_rsvd_page_desc(rtwdev, skb, RSVD_PROBE_REQ);
 		if (skb->len > page_size * RTW_PROBE_PG_CNT) {
+#if defined(__FreeBSD__)
+			kfree_skb(skb);
+#endif
 			ret = -EINVAL;
 			goto out;
 		}
diff --git a/sys/contrib/dev/rtw88/pci.c b/sys/contrib/dev/rtw88/pci.c
index 13e71f44d84f..431d0c1c8b98 100644
--- a/sys/contrib/dev/rtw88/pci.c
+++ b/sys/contrib/dev/rtw88/pci.c
@@ -965,6 +965,9 @@ static int rtw_pci_write_data_rsvd_page(struct rtw_dev *rtwdev, u8 *buf,
 
 	ret = rtw_pci_tx_write_data(rtwdev, &pkt_info, skb, RTW_TX_QUEUE_BCN);
 	if (ret) {
+#if defined(__FreeBSD__)
+		dev_kfree_skb_any(skb);
+#endif
 		rtw_err(rtwdev, "failed to write rsvd page data\n");
 		return ret;
 	}
@@ -989,6 +992,9 @@ static int rtw_pci_write_data_h2c(struct rtw_dev *rtwdev, u8 *buf, u32 size)
 
 	ret = rtw_pci_tx_write_data(rtwdev, &pkt_info, skb, RTW_TX_QUEUE_H2C);
 	if (ret) {
+#if defined(__FreeBSD__)
+		dev_kfree_skb_any(skb);
+#endif
 		rtw_err(rtwdev, "failed to write h2c data\n");
 		return ret;
 	}
diff --git a/sys/contrib/dev/rtw88/tx.c b/sys/contrib/dev/rtw88/tx.c
index f405682c9cbf..a85f09a8d7b2 100644
--- a/sys/contrib/dev/rtw88/tx.c
+++ b/sys/contrib/dev/rtw88/tx.c
@@ -638,7 +638,12 @@ static void rtw_txq_push(struct rtw_dev *rtwdev,
 
 		ret = rtw_txq_push_skb(rtwdev, rtwtxq, skb);
 		if (ret) {
+#if defined(__FreeBSD__)
+			dev_kfree_skb_any(skb);
+			rtw_err(rtwdev, "failed to push skb, ret %d\n", ret);
+#else
 			rtw_err(rtwdev, "failed to pusk skb, ret %d\n", ret);
+#endif
 			break;
 		}
 	}