diff options
| author | Keita Suzuki <[email protected]> | 2020-09-08 12:17:41 +0000 |
|---|---|---|
| committer | Kalle Valo <[email protected]> | 2020-09-09 10:32:29 +0300 |
| commit | f4443293d741d1776b86ed1dd8c4e4285d0775fc (patch) | |
| tree | a4bb212e16785adefd363ee8397e5024e8dd7311 | |
| parent | eb2c6ca2db8c9cf112f0b604c1edfe21b5725f17 (diff) | |
brcmsmac: fix memory leak in wlc_phy_attach_lcnphy
When wlc_phy_txpwr_srom_read_lcnphy fails in wlc_phy_attach_lcnphy,
the allocated pi->u.pi_lcnphy is leaked, since struct brcms_phy will be
freed in the caller function.
Fix this by calling wlc_phy_detach_lcnphy in the error handler of
wlc_phy_txpwr_srom_read_lcnphy before returning.
Signed-off-by: Keita Suzuki <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
| -rw-r--r-- | drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c index b8193c99e864..322bbd71388b 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c @@ -5047,8 +5047,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi) pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft; pi->pi_fptr.detach = wlc_phy_detach_lcnphy; - if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) + if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) { + kfree(pi->u.pi_lcnphy); return false; + } if (LCNREV_IS(pi->pubpi.phy_rev, 1)) { if (pi_lcn->lcnphy_tempsense_option == 3) { |