Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e5969d55 authored by Julia Lawall's avatar Julia Lawall Committed by Greg Kroah-Hartman
Browse files

drivers/staging/bcm/nvm.c: add missing kfree 

Buff is only used as a temporary buffer within the function, so it should
be freed before leaving the function in an error case.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/

)

// <smpl>
@exists@
local idexpression x;
statement S,S1;
expression E;
identifier fl;
expression *ptr != NULL;
@@

x = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
     when != if (...) { <+...kfree(x)...+> }
     when any
     when != true x == NULL
x->fl
...>
(
if (x == NULL) S1
|
if (...) { ... when != x
               when forall
(
 return \(0\|<+...x...+>\|ptr\);
|
* return ...;
)
}
)
// </smpl>

Signed-off-by: default avatarJulia Lawall <julia@diku.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 1dc63477

drivers/staging/bcm/nvm.c

+9 −4
Original line number Diff line number Diff line
@@ -4013,7 +4013,8 @@ INT BcmCopyISO(PMINI_ADAPTER Adapter, FLASH2X_COPY_SECTION sCopySectStrut) 
		if(uiTotalDataToCopy < ISOLength)

		{

			BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0,"error as Source ISO Section does not have valid signature");

			return STATUS_FAILURE;

			Status = STATUS_FAILURE;

			goto out;

		}



		uiTotalDataToCopy =(Adapter->psFlash2xCSInfo->OffsetISOImage2Part1End) -
@@ -4026,7 +4027,8 @@ INT BcmCopyISO(PMINI_ADAPTER Adapter, FLASH2X_COPY_SECTION sCopySectStrut) 
		if(uiTotalDataToCopy < ISOLength)

		{

			BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0,"error as Dest ISO Section does not have enough section size");

			return STATUS_FAILURE;

			Status = STATUS_FAILURE;

			goto out;

		}



		uiTotalDataToCopy = ISOLength;
@@ -4143,7 +4145,8 @@ INT BcmCopyISO(PMINI_ADAPTER Adapter, FLASH2X_COPY_SECTION sCopySectStrut) 
		if(uiTotalDataToCopy < ISOLength)

		{

			BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0,"error as Source ISO Section does not have valid signature");

			return STATUS_FAILURE;

			Status = STATUS_FAILURE;

			goto out;

		}



		uiTotalDataToCopy =(Adapter->psFlash2xCSInfo->OffsetISOImage1Part1End) -
@@ -4156,7 +4159,8 @@ INT BcmCopyISO(PMINI_ADAPTER Adapter, FLASH2X_COPY_SECTION sCopySectStrut) 
		if(uiTotalDataToCopy < ISOLength)

		{

			BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0,"error as Dest ISO Section does not have enough section size");

			return STATUS_FAILURE;

			Status = STATUS_FAILURE;

			goto out;

		}



		uiTotalDataToCopy = ISOLength;
@@ -4257,6 +4261,7 @@ INT BcmCopyISO(PMINI_ADAPTER Adapter, FLASH2X_COPY_SECTION sCopySectStrut) 


	}



out:

	kfree(Buff);



	return Status;