[bug report] wifi: brcmfmac: cfg80211: Add support for scan params v2

[bug report] wifi: brcmfmac: cfg80211: Add support for scan params v2

[Dan Carpenter]

Hello Hector Martin,

The patch 398ce273d6b1: "wifi: brcmfmac: cfg80211: Add support for
scan params v2" from Feb 14, 2023, leads to the following Smatch
static checker warning:

drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1459 brcmf_run_escan() error: potential null dereference 'params_v1'.  (kzalloc returns null)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:4319 brcmf_pmksa_v3_op() error: potential null dereference 'pmk_op'.  (kzalloc returns null)

drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
    1451         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION_V2);
    1452 
    1453         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
    1454                 struct brcmf_escan_params_le *params_v1;
    1455 
    1456                 params_size -= BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
    1457                 params_size += BRCMF_SCAN_PARAMS_FIXED_SIZE;
    1458                 params_v1 = kzalloc(params_size, GFP_KERNEL);

kzalloc() needs a check for failure.

--> 1459                 params_v1->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
    1460                 brcmf_scan_params_v2_to_v1(&params->params_v2_le, &params_v1->params_le);
    1461                 kfree(params);
    1462                 params = params_v1;
    1463         }
    1464 
    1465         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
    1466         params->sync_id = cpu_to_le16(0x1234);
    1467 
    1468         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
    1469         if (err) {
    1470                 if (err == -EBUSY)
    1471                         brcmf_dbg(INFO, "system busy : escan canceled\n");
    1472                 else
    1473                         bphy_err(drvr, "error (%d)\n", err);
    1474         }
    1475 
    1476         kfree(params);
    1477 exit:
    1478         return err;
    1479 }

regards,
dan carpenter