Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8b97745 authored by Christian Engelmayer's avatar Christian Engelmayer Committed by Kalle Valo
Browse files

rsi: Fix possible leak when loading firmware 



Commit 5d5cd85f ("rsi: Fix failure to load firmware after memory
leak fix and fix the leak") also added a check on the allocation of
DMA-accessible memory that may directly return. In that case the
already allocated firmware data is leaked. Make sure the data is
always freed correctly. Detected by Coverity CID 1316519.

Fixes: 5d5cd85f ("rsi: Fix failure to load firmware after memory leak fix and fix the leak")
Signed-off-by: default avatarChristian Engelmayer <cengelma@gmx.at>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 4e70f214

drivers/net/wireless/rsi/rsi_91x_sdio_ops.c

+6 −2
Original line number Diff line number Diff line
@@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common) 


	/* Copy firmware into DMA-accessible memory */

	fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);

	if (!fw)

		return -ENOMEM;

	if (!fw) {

		status = -ENOMEM;

		goto out;

	}

	len = fw_entry->size;



	if (len % 4)
@@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common) 


	status = rsi_copy_to_card(common, fw, len, num_blocks);

	kfree(fw);



out:

	release_firmware(fw_entry);

	return status;

}

drivers/net/wireless/rsi/rsi_91x_usb_ops.c

+6 −2
Original line number Diff line number Diff line
@@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common) 


	/* Copy firmware into DMA-accessible memory */

	fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);

	if (!fw)

		return -ENOMEM;

	if (!fw) {

		status = -ENOMEM;

		goto out;

	}

	len = fw_entry->size;



	if (len % 4)
@@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common) 


	status = rsi_copy_to_card(common, fw, len, num_blocks);

	kfree(fw);



out:

	release_firmware(fw_entry);

	return status;

}