diff options
| author | Rosen Penev <rosenp@gmail.com> | 2026-04-07 15:15:19 -0700 |
|---|---|---|
| committer | Bjorn Andersson <andersson@kernel.org> | 2026-05-09 10:28:49 -0500 |
| commit | 75c9015d0d8b66ef878ac6c4b753175ada3f8aa5 (patch) | |
| tree | db3e0ca6e618a463c7118804ad2d34e3197e128a | |
| parent | a1b94131042930114d0257c44362ee16bca18f4a (diff) | |
soc: qcom: wcnss: fix leak of fw
The kzalloc_flex call needs to release it, not just blindly return.
Also move kfree up as it is allocated after fw.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202604060902.awXdPsBh-lkp@intel.com/
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260407221519.6824-1-rosenp@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
| -rw-r--r-- | drivers/soc/qcom/wcnss_ctrl.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/soc/qcom/wcnss_ctrl.c b/drivers/soc/qcom/wcnss_ctrl.c index ffb31a049d4a..942e11feba65 100644 --- a/drivers/soc/qcom/wcnss_ctrl.c +++ b/drivers/soc/qcom/wcnss_ctrl.c @@ -221,8 +221,10 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc) left = fw->size; req = kzalloc_flex(*req, fragment, NV_FRAGMENT_SIZE); - if (!req) - return -ENOMEM; + if (!req) { + ret = -ENOMEM; + goto release_fw; + } req->frag_size = NV_FRAGMENT_SIZE; req->hdr.type = WCNSS_DOWNLOAD_NV_REQ; @@ -243,7 +245,7 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc) ret = rpmsg_send(wcnss->channel, req, req->hdr.len); if (ret < 0) { dev_err(dev, "failed to send smd packet\n"); - goto release_fw; + goto release_req; } /* Increment for next fragment */ @@ -262,9 +264,10 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc) ret = 0; } +release_req: + kfree(req); release_fw: release_firmware(fw); - kfree(req); return ret; } |