wifi: iwlwifi: mvm: rfi: fix potential response leaks

jira LE-1907
cve CVE-2024-35912
Rebuild_History Non-Buildable kernel-4.18.0-553.16.1.el8_10
commit-author Johannes Berg <[email protected]>
commit 06a0938

If the rx payload length check fails, or if kmemdup() fails,
we still need to free the command response. Fix that.

Fixes: 2125490 ("iwlwifi: mvm: add RFI-M support")
Co-authored-by: Anjaneyulu <[email protected]>
	Signed-off-by: Johannes Berg <[email protected]>
	Signed-off-by: Miri Korenblit <[email protected]>
Link: https://msgid.link/20240319100755.db2fa0196aa7.I116293b132502ac68a65527330fa37799694b79c@changeid
	Signed-off-by: Johannes Berg <[email protected]>
(cherry picked from commit 06a0938)
	Signed-off-by: Jonathan Maple <[email protected]>

Author: PlaidCat

drivers/net/wireless/intel/iwlwifi/mvm/rfi.c

@@ -132,14 +132,18 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm)
 	if (ret)
 		return ERR_PTR(ret);
 
-	if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) != resp_size))
+	if (WARN_ON_ONCE(iwl_rx_packet_payload_len(cmd.resp_pkt) !=
+			 resp_size)) {
+		iwl_free_resp(&cmd);
 		return ERR_PTR(-EIO);
+	}
 
 	resp = kmemdup(cmd.resp_pkt->data, resp_size, GFP_KERNEL);
+	iwl_free_resp(&cmd);
+
 	if (!resp)
 		return ERR_PTR(-ENOMEM);
 
-	iwl_free_resp(&cmd);
 	return resp;
 }