rsi: Fix possible leak when loading firmware

Commit 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory
leak fix and fix the leak") also added a check on the allocation of
DMA-accessible memory that may directly return. In that case the
already allocated firmware data is leaked. Make sure the data is
always freed correctly. Detected by Coverity CID 1316519.

Fixes: 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory leak fix and fix the leak")
Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
index 1c6788aecc62658fe2cc7c4961415ef4715c8dde..40d72312f3df21dd6e4e12019febd6363a6f7912 100644 (file)
--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
 
        /* Copy firmware into DMA-accessible memory */
        fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
-       if (!fw)
-               return -ENOMEM;
+       if (!fw) {
+               status = -ENOMEM;
+               goto out;
+       }
        len = fw_entry->size;
 
        if (len % 4)
@@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
 
        status = rsi_copy_to_card(common, fw, len, num_blocks);
        kfree(fw);
+
+out:
        release_firmware(fw_entry);
        return status;
 }

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
index 30c2cf7fa93b0c6015d22236c3a9189b462cb064..de4900862836a55019a3033ad7045ac2fcc186d6 100644 (file)
--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
@@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
 
        /* Copy firmware into DMA-accessible memory */
        fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
-       if (!fw)
-               return -ENOMEM;
+       if (!fw) {
+               status = -ENOMEM;
+               goto out;
+       }
        len = fw_entry->size;
 
        if (len % 4)
@@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
 
        status = rsi_copy_to_card(common, fw, len, num_blocks);
        kfree(fw);
+
+out:
        release_firmware(fw_entry);
        return status;
 }