Commit a8b97745 authored by Christian Engelmayer's avatar Christian Engelmayer Committed by Kalle Valo

rsi: Fix possible leak when loading firmware

Commit 5d5cd85f ("rsi: Fix failure to load firmware after memory
leak fix and fix the leak") also added a check on the allocation of
DMA-accessible memory that may directly return. In that case the
already allocated firmware data is leaked. Make sure the data is
always freed correctly. Detected by Coverity CID 1316519.

Fixes: 5d5cd85f ("rsi: Fix failure to load firmware after memory leak fix and fix the leak")
Signed-off-by: default avatarChristian Engelmayer <cengelma@gmx.at>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 4e70f214
...@@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common) ...@@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
/* Copy firmware into DMA-accessible memory */ /* Copy firmware into DMA-accessible memory */
fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
if (!fw) if (!fw) {
return -ENOMEM; status = -ENOMEM;
goto out;
}
len = fw_entry->size; len = fw_entry->size;
if (len % 4) if (len % 4)
...@@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common) ...@@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
status = rsi_copy_to_card(common, fw, len, num_blocks); status = rsi_copy_to_card(common, fw, len, num_blocks);
kfree(fw); kfree(fw);
out:
release_firmware(fw_entry); release_firmware(fw_entry);
return status; return status;
} }
......
...@@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common) ...@@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
/* Copy firmware into DMA-accessible memory */ /* Copy firmware into DMA-accessible memory */
fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
if (!fw) if (!fw) {
return -ENOMEM; status = -ENOMEM;
goto out;
}
len = fw_entry->size; len = fw_entry->size;
if (len % 4) if (len % 4)
...@@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common) ...@@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
status = rsi_copy_to_card(common, fw, len, num_blocks); status = rsi_copy_to_card(common, fw, len, num_blocks);
kfree(fw); kfree(fw);
out:
release_firmware(fw_entry); release_firmware(fw_entry);
return status; return status;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment