Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cae7f953 authored by Christian Lamparter's avatar Christian Lamparter Committed by John W. Linville
Browse files

carl9170: fix async command buffer leak 



If __carl9170_exec_cmd fails to upload an asynchronous
command to the device, the functions: carl9170_reboot
and carl9170_powersave will leak the temporary command
assembly buffer.

Signed-off-by: default avatarChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 9192f715

drivers/net/wireless/ath/carl9170/usb.c

+19 −6
Original line number Diff line number Diff line
@@ -591,16 +591,23 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd, 
			const bool free_buf)

{

	struct urb *urb;

	int err = 0;



	if (!IS_INITIALIZED(ar))

		return -EPERM;

	if (!IS_INITIALIZED(ar)) {

		err = -EPERM;

		goto err_free;

	}



	if (WARN_ON(cmd->hdr.len > CARL9170_MAX_CMD_LEN - 4))

		return -EINVAL;

	if (WARN_ON(cmd->hdr.len > CARL9170_MAX_CMD_LEN - 4)) {

		err = -EINVAL;

		goto err_free;

	}



	urb = usb_alloc_urb(0, GFP_ATOMIC);

	if (!urb)

		return -ENOMEM;

	if (!urb) {

		err = -ENOMEM;

		goto err_free;

	}



	usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,

		AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
@@ -613,6 +620,12 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd, 
	usb_free_urb(urb);



	return carl9170_usb_submit_cmd_urb(ar);



err_free:

	if (free_buf)

		kfree(cmd);



	return err;

}



int carl9170_exec_cmd(struct ar9170 *ar, const enum carl9170_cmd_oids cmd,