| Message ID | 1b5d80f54c1dbf85710fd285243932943b498fe7.1630614969.git.christophe.jaillet@wanadoo.fr |
|---|---|
| State | New |
| Headers | show |
| Series | iwlwifi: pnvm: Fix a memory leak in 'iwl_pnvm_get_from_fs()' | expand |
On Fri, 2021-09-03 at 11:19 +0300, Dan Carpenter wrote: > On Thu, Sep 02, 2021 at 10:38:11PM +0200, Christophe JAILLET wrote: > > A firmware is requested but never released in this function. This leads to > > a memory leak in the normal execution path. > > > > Add the missing 'release_firmware()' call. > > Also introduce a temp variable (new_len) in order to keep the value of > > 'pnvm->size' after the firmware has been released. > > > > Fixes: cdda18fbbefa ("iwlwifi: pnvm: move file loading code to a separate function") > > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > > Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Luca Coelho <luca@coelho.fi> Kalle, can you please queue this for v5.15? I'll assign it to you. Thanks! -- Cheers, Luca.
Christophe JAILLET <christophe.jaillet@wanadoo.fr> wrote: > A firmware is requested but never released in this function. This leads to > a memory leak in the normal execution path. > > Add the missing 'release_firmware()' call. > Also introduce a temp variable (new_len) in order to keep the value of > 'pnvm->size' after the firmware has been released. > > Fixes: cdda18fbbefa ("iwlwifi: pnvm: move file loading code to a separate function") > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> > Acked-by: Luca Coelho <luca@coelho.fi> Patch applied to wireless-drivers.git, thanks. 45010c080e6e iwlwifi: pnvm: Fix a memory leak in 'iwl_pnvm_get_from_fs()'
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c index 314ed90c23dd..dde22bdc8703 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c +++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c @@ -231,6 +231,7 @@ static int iwl_pnvm_get_from_fs(struct iwl_trans *trans, u8 **data, size_t *len) { const struct firmware *pnvm; char pnvm_name[MAX_PNVM_NAME]; + size_t new_len; int ret; iwl_pnvm_get_fs_name(trans, pnvm_name, sizeof(pnvm_name)); @@ -242,11 +243,14 @@ static int iwl_pnvm_get_from_fs(struct iwl_trans *trans, u8 **data, size_t *len) return ret; } + new_len = pnvm->size; *data = kmemdup(pnvm->data, pnvm->size, GFP_KERNEL); + release_firmware(pnvm); + if (!*data) return -ENOMEM; - *len = pnvm->size; + *len = new_len; return 0; }
A firmware is requested but never released in this function. This leads to a memory leak in the normal execution path. Add the missing 'release_firmware()' call. Also introduce a temp variable (new_len) in order to keep the value of 'pnvm->size' after the firmware has been released. Fixes: cdda18fbbefa ("iwlwifi: pnvm: move file loading code to a separate function") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> --- drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)