From fde5d2e21079d7bcbc9c83fdcc7ef946d37d09dd Mon Sep 17 00:00:00 2001 From: Vladimir Palevich Date: Fri, 20 Mar 2026 21:46:04 +0100 Subject: [PATCH] hostapd: fix memory leak in rrm ubus interface Add missing wpabuf_free calls to the hostapd_rrm_nr_set and hostapd_rrm_beacon_req functions. Signed-off-by: Vladimir Palevich Link: https://github.com/openwrt/openwrt/pull/22538 Signed-off-by: Nick Hainke --- package/network/services/hostapd/src/src/ap/ubus.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c index 514f56eebd..d10fd9a04f 100644 --- a/package/network/services/hostapd/src/src/ap/ubus.c +++ b/package/network/services/hostapd/src/src/ap/ubus.c @@ -1123,9 +1123,9 @@ hostapd_rrm_nr_set(struct ubus_context *ctx, struct ubus_object *obj, if (strlen(s) == 0) { /* Copy BSSID from neighbor report */ if (hwaddr_compact_aton(nr_s, bssid)) - goto invalid; + goto invalid_free; } else if (hwaddr_aton(s, bssid)) { - goto invalid; + goto invalid_free; } /* SSID */ @@ -1136,7 +1136,7 @@ hostapd_rrm_nr_set(struct ubus_context *ctx, struct ubus_object *obj, } else { ssid.ssid_len = strlen(s); if (ssid.ssid_len > sizeof(ssid.ssid)) - goto invalid; + goto invalid_free; memcpy(&ssid, s, ssid.ssid_len); } @@ -1145,6 +1145,8 @@ hostapd_rrm_nr_set(struct ubus_context *ctx, struct ubus_object *obj, wpabuf_free(data); continue; +invalid_free: + wpabuf_free(data); invalid: return UBUS_STATUS_INVALID_ARGUMENT; } @@ -1252,6 +1254,7 @@ hostapd_rrm_beacon_req(struct ubus_context *ctx, struct ubus_object *obj, } ret = hostapd_send_beacon_req(hapd, addr, 0, req); + wpabuf_free(req); if (ret < 0) return -ret;