il3945_pci_probe() calls il_eeprom_init(), which allocates memory for
the EEPROM data. The probe failure paths release this allocation with
il_eeprom_free(), but the remove path does not free it after a
successful probe.

As a result, the EEPROM data is leaked when the PCI device is removed.

Free the EEPROM data in il3945_pci_remove() before releasing the
mac80211 hardware structure.

This issue was found by manual code inspection.

Fixes: 073d3f5f1b3b ("iwlwifi: changing EEPROM layout handling")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
index cbaf250626c5..f7ca182d1494 100644
--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
@@ -3807,6 +3807,7 @@ il3945_pci_remove(struct pci_dev *pdev)
 
 	il_free_channel_map(il);
 	il_free_geos(il);
+	il_eeprom_free(il);
 	kfree(il->scan_cmd);
 	dev_kfree_skb(il->beacon_skb);
 	ieee80211_free_hw(il->hw);
-- 
2.43.0

On Wed, Sep 16, 2026 at 03:37:36PM +0800, Guangshuo Li wrote:
> il3945_pci_probe() calls il_eeprom_init(), which allocates memory for
> the EEPROM data. The probe failure paths release this allocation with
> il_eeprom_free(), but the remove path does not free it after a
> successful probe.
> 
> As a result, the EEPROM data is leaked when the PCI device is removed.
> 
> Free the EEPROM data in il3945_pci_remove() before releasing the
> mac80211 hardware structure.
> 
> This issue was found by manual code inspection.
> 
> Fixes: 073d3f5f1b3b ("iwlwifi: changing EEPROM layout handling")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>

> ---
>  drivers/net/wireless/intel/iwlegacy/3945-mac.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> index cbaf250626c5..f7ca182d1494 100644
> --- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> +++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
> @@ -3807,6 +3807,7 @@ il3945_pci_remove(struct pci_dev *pdev)
>  
>  	il_free_channel_map(il);
>  	il_free_geos(il);
> +	il_eeprom_free(il);
>  	kfree(il->scan_cmd);
>  	dev_kfree_skb(il->beacon_skb);
>  	ieee80211_free_hw(il->hw);
> -- 
> 2.43.0
>