From patchwork Fri Aug 21 21:14:26 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Engelmayer X-Patchwork-Id: 7053921 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 19A8E9F373 for ; Fri, 21 Aug 2015 21:15:17 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 4CE8A205FD for ; Fri, 21 Aug 2015 21:15:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5E85B205FA for ; Fri, 21 Aug 2015 21:15:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752942AbbHUVOz (ORCPT ); Fri, 21 Aug 2015 17:14:55 -0400 Received: from mout.gmx.net ([212.227.15.18]:56353 "EHLO mout.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752460AbbHUVOx (ORCPT ); Fri, 21 Aug 2015 17:14:53 -0400 Received: from localhost.localdomain ([81.217.123.197]) by mail.gmx.com (mrgmx003) with ESMTPSA (Nemesis) id 0MIdTM-1ZV6ZM47XE-002EIH; Fri, 21 Aug 2015 23:14:49 +0200 From: Christian Engelmayer To: kvalo@codeaurora.org, mike.looijmans@topic.nl Cc: khoroshilov@ispras.ru, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Christian Engelmayer Subject: [PATCH] rsi: Fix possible leak when loading firmware Date: Fri, 21 Aug 2015 23:14:26 +0200 Message-Id: <1440191666-5104-1-git-send-email-cengelma@gmx.at> X-Mailer: git-send-email 1.9.1 X-Provags-ID: V03:K0:jBKld39k7tz+5edhY1LBQQw/C/Aej7nOrdfHPdhep2K4Pny8Dyw wE91ZvTTc3jvNq8qXKKSBmHrsZpJpo6NVbI4+ZjeshDacfVL0ajUDsbeGp3jADd++M5pOI+ CoWVu9kWsEgrR/fSSQA0PnRetuGWUvYH/C+2JStT9FLa7XbBc4RN3aET2/GMJvTGOP3t9Jr K10QFxYZPd0NdK3vzxDMg== X-UI-Out-Filterresults: notjunk:1; V01:K0:NjK1lXzdYng=:5vVZrWjEjnujbZ058P9R47 wVx11vttkGAtJ1ESo8NYTvjjEpCrZpiFOfENH9PvE5SlPQCf9vMahbXmO+b/3RRzW8nOstuV/ coBOdNhWD/mbbaJ01niWdraw3CU77GqzwUAHoEZmcALeNbTHMvUblfFkPLFidI2nu/Iof+tOw paxJR0qj8RFl554Ft5zeohy2SLWyU/dvKByHjgd7gzlWFn8yaZUbD8o3au8akmFkGAHuRsT0v 0G9edz49/xSsLVsqtOqnJ5yuev74T7D7NJ/jRdJuK5eGOtJKlOSSoGPR1KW2AVug8V/U0eCmi pxUtvCUQxPWqg9VbzC3JB/FBd8k5+GglBXpoWwa4dj2tL0X+uUGotIjzGNn09x4yjPwJQA/9Z igol5/2k2H0Zs5VAU6xSH6L0IYrubritNdiD4qthJU544Cl4zE9Wr0bIM7l13L7P4cIWgq5RW j7ujrvXchE49bqF6L3TSRRvjecWFDCKiriTgOexgdp7NpgVyoKzx4whL1oiVAKlheyp6hNBMU VqZd8+/2vfHRnrg1QhoSHPFF8Z4aqkf4gtwFE3g3W9pbermomQ10eFXbz2vOuho+IqrscRWya fN4gPMTRaJzKbdAwyuz0Bs+G4ZPK2X61bSx1QYltxX41iGImehsWaMXy0MItnF8Clh9uDukNJ QlP4OlKayxjUwNmzD8jv2IE26dg3eiicOyRwmeQmG447/ypUzFpuV6rFU4gtwoihDx2Y9Xg22 afTIj+ummkC1VHOV Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory leak fix and fix the leak") also added a check on the allocation of DMA-accessible memory that may directly return. In that case the already allocated firmware data is leaked. Make sure the data is always freed correctly. Detected by Coverity CID 1316519. Signed-off-by: Christian Engelmayer --- Compile tested only. --- drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 8 ++++++-- drivers/net/wireless/rsi/rsi_91x_usb_ops.c | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c index 1c6788aecc62..40d72312f3df 100644 --- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c +++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c @@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common) /* Copy firmware into DMA-accessible memory */ fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); - if (!fw) - return -ENOMEM; + if (!fw) { + status = -ENOMEM; + goto out; + } len = fw_entry->size; if (len % 4) @@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common) status = rsi_copy_to_card(common, fw, len, num_blocks); kfree(fw); + +out: release_firmware(fw_entry); return status; } diff --git a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c index 30c2cf7fa93b..de4900862836 100644 --- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c +++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c @@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common) /* Copy firmware into DMA-accessible memory */ fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); - if (!fw) - return -ENOMEM; + if (!fw) { + status = -ENOMEM; + goto out; + } len = fw_entry->size; if (len % 4) @@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common) status = rsi_copy_to_card(common, fw, len, num_blocks); kfree(fw); + +out: release_firmware(fw_entry); return status; }