wifi: nxpwifi: handle authentication frame allocation failures

nxpwifi_cfg80211_authenticate() allocates the buffer it builds the
management frame in and never checks the result:

	mgmt = kzalloc(frame_len, GFP_KERNEL);

	skb = dev_alloc_skb(...);
	if (!skb) {
		...
		return -ENOMEM;
	}
	...
	memcpy(mgmt->da, req->bss->bssid, ETH_ALEN);

On allocation failure the memcpy() a dozen lines later dereferences NULL.
The same sequence leaks mgmt when dev_alloc_skb() fails: that path
returns without freeing it, while the success path drops it after
nxpwifi_form_mgmt_frame().

Bail out when the allocation fails, and free it before returning on the
skb error path.

Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>

0 files changed, 0 insertions, 0 deletions