public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-03 15:55:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

mei: nfc: fix memory leak in error path

Browse source 
NFC will leak buffer if send failed.
Use single exit point that does the freeing

Cc: stable@vger.kernel.org #3.10+
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alexander Usyskin 2014-08-12 18:07:57 +03:00 • committed by Greg Kroah-Hartman
parent 73ab423238
commit 8e8248b136
1 changed files with 5 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
drivers/misc/mei/nfc.c
View file

@ -342,9 +342,10 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
ndev = (struct mei_nfc_dev *) cldev->priv_data; ndev = (struct mei_nfc_dev *) cldev->priv_data;
dev = ndev->cl->dev; dev = ndev->cl->dev;
err = -ENOMEM;
mei_buf = kzalloc(length + MEI_NFC_HEADER_SIZE, GFP_KERNEL); mei_buf = kzalloc(length + MEI_NFC_HEADER_SIZE, GFP_KERNEL);
if (!mei_buf) if (!mei_buf)
return -ENOMEM; goto out;
hdr = (struct mei_nfc_hci_hdr *) mei_buf; hdr = (struct mei_nfc_hci_hdr *) mei_buf;
hdr->cmd = MEI_NFC_CMD_HCI_SEND; hdr->cmd = MEI_NFC_CMD_HCI_SEND;
@ -354,12 +355,9 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
hdr->data_size = length; hdr->data_size = length;
memcpy(mei_buf + MEI_NFC_HEADER_SIZE, buf, length); memcpy(mei_buf + MEI_NFC_HEADER_SIZE, buf, length);
err = __mei_cl_send(ndev->cl, mei_buf, length + MEI_NFC_HEADER_SIZE); err = __mei_cl_send(ndev->cl, mei_buf, length + MEI_NFC_HEADER_SIZE);
if (err < 0) if (err < 0)
return err; goto out;
kfree(mei_buf);
if (!wait_event_interruptible_timeout(ndev->send_wq, if (!wait_event_interruptible_timeout(ndev->send_wq,
ndev->recv_req_id == ndev->req_id, HZ)) { ndev->recv_req_id == ndev->req_id, HZ)) {
@ -368,7 +366,8 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
} else { } else {
ndev->req_id++; ndev->req_id++;
} }
out:
kfree(mei_buf);
return err; return err;
} }