[PATCH] wifi: nl80211: call kfree without a NULL check

[PATCH] wifi: nl80211: call kfree without a NULL check

[Emmanuel Grumbach]

Coverity is unhappy because we may leak old_radio_rts_threshold. Since
this pointer is only valid in the context of the function and kfree is
NULL pointer safe, don't check and just call kfree.
Note that somehow, we were checking old_rts_threshold to free
old_radio_rts_threshold which is a bit odd.

Fixes: 264637941cf4 ("wifi: cfg80211: Add Support to Set RTS Threshold for each Radio")
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
---
 net/wireless/nl80211.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 346dfd2bd987..03d07b54359a 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4136,8 +4136,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 			rdev->wiphy.txq_quantum = old_txq_quantum;
 		}
 
-		if (old_rts_threshold)
-			kfree(old_radio_rts_threshold);
+		kfree(old_radio_rts_threshold);
 		return result;
 	}
 
-- 
2.51.0

Re: [PATCH] wifi: nl80211: call kfree without a NULL check

[Jeff Johnson]

On 10/20/2025 12:57 AM, Emmanuel Grumbach wrote:
> Coverity is unhappy because we may leak old_radio_rts_threshold.

Is this being flagged in a public Coverity instance?

I don't see this at either of:
https://scan.coverity.com/projects/linux
https://scan.coverity.com/projects/linux-next-weekly-scan

> Fixes: 264637941cf4 ("wifi: cfg80211: Add Support to Set RTS Threshold for each Radio")

If there is a public instance, would be nice to add a Closes: tag that points
to it

> Reviewed-by: Johannes Berg <johannes.berg@intel.com>

Reviewed-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>

> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
> ---
>  net/wireless/nl80211.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> index 346dfd2bd987..03d07b54359a 100644
> --- a/net/wireless/nl80211.c
> +++ b/net/wireless/nl80211.c
> @@ -4136,8 +4136,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
>  			rdev->wiphy.txq_quantum = old_txq_quantum;
>  		}
>  
> -		if (old_rts_threshold)
> -			kfree(old_radio_rts_threshold);
> +		kfree(old_radio_rts_threshold);
>  		return result;
>  	}
>  

Re: [PATCH] wifi: nl80211: call kfree without a NULL check

[Grumbach, Emmanuel]

On Mon, 2025-10-20 at 07:34 -0700, Jeff Johnson wrote:
> On 10/20/2025 12:57 AM, Emmanuel Grumbach wrote:
> > Coverity is unhappy because we may leak old_radio_rts_threshold.
> 
> Is this being flagged in a public Coverity instance?
> 
> I don't see this at either of:
> https://scan.coverity.com/projects/linux
> https://scan.coverity.com/projects/linux-next-weekly-scan
> 

 Not that I am aware of. This was flagged by our internal instance.

> > Fixes: 264637941cf4 ("wifi: cfg80211: Add Support to Set RTS
> > Threshold for each Radio")
> 
> If there is a public instance, would be nice to add a Closes: tag
> that points
> to it
> 
> > Reviewed-by: Johannes Berg <johannes.berg@intel.com>
> 
> Reviewed-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
> 
> > Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
> > ---
> >  net/wireless/nl80211.c | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
> > 
> > diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> > index 346dfd2bd987..03d07b54359a 100644
> > --- a/net/wireless/nl80211.c
> > +++ b/net/wireless/nl80211.c
> > @@ -4136,8 +4136,7 @@ static int nl80211_set_wiphy(struct sk_buff
> > *skb, struct genl_info *info)
> >  			rdev->wiphy.txq_quantum = old_txq_quantum;
> >  		}
> >  
> > -		if (old_rts_threshold)
> > -			kfree(old_radio_rts_threshold);
> > +		kfree(old_radio_rts_threshold);
> >  		return result;
> >  	}
> >