diff options
| author | Colin Ian King <colin.king@canonical.com> | 2016-02-25 23:24:27 +0000 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2016-03-07 14:39:05 +0200 |
| commit | 2b02a36d12192f2a86388913143cd1e399eb971c (patch) | |
| tree | fb62b77021babc4c21196bfcde25cc63f4cec9ae /drivers/net/wireless/mediatek | |
| parent | 354a1947a02528b19ee326e230cb44399cd31865 (diff) | |
| download | linux-2b02a36d12192f2a86388913143cd1e399eb971c.tar.bz2 | |
mt7601u: do not free dma_buf when ivp allocation fails
If the allocation of ivp fails the error handling attempts to
free an uninitialized dma_buf; this data structure just contains
garbage on the stack, so the freeing will cause issues when the
urb, buf and dma fields are free'd. Fix this by not free'ing the
dma_buf if the ivp allocation fails.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/mediatek')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt7601u/mcu.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt7601u/mcu.c b/drivers/net/wireless/mediatek/mt7601u/mcu.c index fbb1986eda3c..91c4b3427965 100644 --- a/drivers/net/wireless/mediatek/mt7601u/mcu.c +++ b/drivers/net/wireless/mediatek/mt7601u/mcu.c @@ -362,7 +362,9 @@ mt7601u_upload_firmware(struct mt7601u_dev *dev, const struct mt76_fw *fw) int i, ret; ivb = kmemdup(fw->ivb, sizeof(fw->ivb), GFP_KERNEL); - if (!ivb || mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf)) { + if (!ivb) + return -ENOMEM; + if (mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf)) { ret = -ENOMEM; goto error; } |