Add error handling for rtw_enqueue_cmd() failures in multiple event
reporting functions.

When rtw_enqueue_cmd() fails to enqueue a command, the allocated memory
for the command object and its parameter buffer is not freed, causing
memory leaks. Add proper error checks and free the allocated memory on
failure in report_survey_event(), report_surveydone_event(),
report_join_res(), report_wmm_edca_update(), report_del_sta_event(),
report_add_sta_event(), and survey_timer_hdl().

Signed-off-by: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>
---
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 34 +++++++++----------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index f0e3f5568..f0831d582 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -4431,10 +4431,10 @@ void report_survey_event(struct adapter *padapter, union recv_frame *precv_frame
 	process_80211d(padapter, &psurvey_evt->bss);
 
 	if (rtw_enqueue_cmd(pcmdpriv, pcmd_obj) == _FAIL) {
-	kfree(pcmd_obj);
-	kfree(pevtcmd);
+		kfree(pcmd_obj);
+		kfree(pevtcmd);
 	return;
-	}
+			}
 
 	pmlmeext->sitesurvey_res.bss_cnt++;
 
@@ -4481,8 +4481,8 @@ void report_surveydone_event(struct adapter *padapter)
 	psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
 
 	if (rtw_enqueue_cmd(pcmdpriv, pcmd_obj) == _FAIL) {
-	kfree(pcmd_obj);
-	kfree(pevtcmd);
+		kfree(pcmd_obj);
+		kfree(pevtcmd);
 	}
 
 	return;
@@ -4534,8 +4534,8 @@ void report_join_res(struct adapter *padapter, int res)
 
 
 	if (rtw_enqueue_cmd(pcmdpriv, pcmd_obj) == _FAIL) {
-	kfree(pcmd_obj);
-	kfree(pevtcmd);
+		kfree(pcmd_obj);
+		kfree(pevtcmd);
 	}
 
 	return;
@@ -4581,8 +4581,8 @@ void report_wmm_edca_update(struct adapter *padapter)
 	pwmm_event->wmm = 0;
 
 	if (rtw_enqueue_cmd(pcmdpriv, pcmd_obj) == _FAIL) {
-	kfree(pcmd_obj);
-	kfree(pevtcmd);
+		kfree(pcmd_obj);
+		kfree(pevtcmd);
 	}
 
 	return;
@@ -4640,9 +4640,9 @@ void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsi
 	pdel_sta_evt->mac_id = mac_id;
 
 	if (rtw_enqueue_cmd(pcmdpriv, pcmd_obj) == _FAIL) {
-	kfree(pcmd_obj);
-	kfree(pevtcmd);
- }
+		kfree(pcmd_obj);
+		kfree(pevtcmd);
+	}
 }
 
 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
@@ -4685,9 +4685,9 @@ void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int
 	padd_sta_evt->cam_id = cam_idx;
 
 	if (rtw_enqueue_cmd(pcmdpriv, pcmd_obj) == _FAIL) {
-	kfree(pcmd_obj);
-	kfree(pevtcmd);
- }
+		kfree(pcmd_obj);
+		kfree(pevtcmd);
+	}
 }
 
 /* Following are the event callback functions */
@@ -5116,8 +5116,8 @@ void survey_timer_hdl(struct timer_list *t)
 
 		init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
 		if (rtw_enqueue_cmd(pcmdpriv, ph2c) == _FAIL) {
-	kfree(ph2c);
-	kfree(psurveyPara);
+			kfree(ph2c);
+			kfree(psurveyPara);
 	}
 	}
 }
-- 
2.47.3

On Fri, Dec 12, 2025 at 01:09:21PM +0400, Giorgi Tchankvetadze wrote:
> Add error handling for rtw_enqueue_cmd() failures in multiple event
> reporting functions.
> 
> When rtw_enqueue_cmd() fails to enqueue a command, the allocated memory
> for the command object and its parameter buffer is not freed, causing
> memory leaks. Add proper error checks and free the allocated memory on
> failure in report_survey_event(), report_surveydone_event(),
> report_join_res(), report_wmm_edca_update(), report_del_sta_event(),
> report_add_sta_event(), and survey_timer_hdl().
> 
> Signed-off-by: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>

What?  The patch is apparently against a tree that doesn't exist and it
just messes up the indenting.

I've reviewed some of your other emails to LMKL and I'm wondering if
you're doing AI stuff or something?  What's going on?

regards,
dan carpenter

Hi Dan,

Thank you for catching this. You're absolutely right and I was in the
process of fixing it by the time you mailed me.
The patch is broken due to a workflow error on my side. I made the
code changes first, then tried to fix indentation in a subsequent edit
on the same branch. This caused git to think the if statements already
existed and only show whitespace changes.

The actual intent was to change:
    rtw_enqueue_cmd(pcmdpriv, pcmd_obj);  <<<<<<<<<<<<<< (ORIGINAL )

To:
    if (rtw_enqueue_cmd(pcmdpriv, pcmd_obj) == _FAIL) {
        kfree(pcmd_obj);
        kfree(pevtcmd);
    }


I will resend v2 from a clean master branch with the changes applied
correctly in a single commit.

Apologies for the noise.

Best regards,
Giorgi

On Fri, Dec 12, 2025 at 1:23 PM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> On Fri, Dec 12, 2025 at 01:09:21PM +0400, Giorgi Tchankvetadze wrote:
> > Add error handling for rtw_enqueue_cmd() failures in multiple event
> > reporting functions.
> >
> > When rtw_enqueue_cmd() fails to enqueue a command, the allocated memory
> > for the command object and its parameter buffer is not freed, causing
> > memory leaks. Add proper error checks and free the allocated memory on
> > failure in report_survey_event(), report_surveydone_event(),
> > report_join_res(), report_wmm_edca_update(), report_del_sta_event(),
> > report_add_sta_event(), and survey_timer_hdl().
> >
> > Signed-off-by: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>
>
> What?  The patch is apparently against a tree that doesn't exist and it
> just messes up the indenting.
>
> I've reviewed some of your other emails to LMKL and I'm wondering if
> you're doing AI stuff or something?  What's going on?
>
> regards,
> dan carpenter
>