Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eae79b4f authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Kalle Valo
Browse files

rsi: fix memory leak in rsi_load_ta_instructions() 



Memory allocated by kmemdup() in rsi_load_ta_instructions() is leaked.
But duplication of firmware data here is useless,
so the patch removes kmemdup() at all.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 18e0c0bf

drivers/net/wireless/rsi/rsi_91x_sdio_ops.c

+1 −3
Original line number Original line Diff line number Diff line
@@ -172,7 +172,6 @@ static int rsi_load_ta_instructions(struct rsi_common *common) 
		(struct rsi_91x_sdiodev *)adapter->rsi_dev;

		(struct rsi_91x_sdiodev *)adapter->rsi_dev;

	u32 len;

	u32 len;

	u32 num_blocks;

	u32 num_blocks;

	const u8 *fw;

	const struct firmware *fw_entry = NULL;

	const struct firmware *fw_entry = NULL;

	u32 block_size = dev->tx_blk_size;

	u32 block_size = dev->tx_blk_size;

	int status = 0;

	int status = 0;
@@ -201,7 +200,6 @@ static int rsi_load_ta_instructions(struct rsi_common *common) 
		return status;

		return status;

	}

	}





	fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);

	len = fw_entry->size;

	len = fw_entry->size;





	if (len % 4)

	if (len % 4)
@@ -212,7 +210,7 @@ static int rsi_load_ta_instructions(struct rsi_common *common) 
	rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len);

	rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len);

	rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks);

	rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks);





	status = rsi_copy_to_card(common, fw, len, num_blocks);

	status = rsi_copy_to_card(common, fw_entry->data, len, num_blocks);

	release_firmware(fw_entry);

	release_firmware(fw_entry);

	return status;

	return status;

}

}