diff options
| author | Christian Lamparter <chunkeey@googlemail.com> | 2010-10-16 01:38:46 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-10-25 14:43:13 -0400 |
| commit | cae7f953e8afa9b1ce234fd0907183b643cc5ab8 (patch) | |
| tree | b1755091c8b48bcdafda1656f8cc7404bc05bee2 /drivers/net | |
| parent | 9192f715bc6304b97fe06c6215d4897a5c279e81 (diff) | |
carl9170: fix async command buffer leak
If __carl9170_exec_cmd fails to upload an asynchronous
command to the device, the functions: carl9170_reboot
and carl9170_powersave will leak the temporary command
assembly buffer.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/ath/carl9170/usb.c | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c index c7f6193934ea..d8607f4c144d 100644 --- a/drivers/net/wireless/ath/carl9170/usb.c +++ b/drivers/net/wireless/ath/carl9170/usb.c @@ -591,16 +591,23 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd, const bool free_buf) { struct urb *urb; + int err = 0; - if (!IS_INITIALIZED(ar)) - return -EPERM; + if (!IS_INITIALIZED(ar)) { + err = -EPERM; + goto err_free; + } - if (WARN_ON(cmd->hdr.len > CARL9170_MAX_CMD_LEN - 4)) - return -EINVAL; + if (WARN_ON(cmd->hdr.len > CARL9170_MAX_CMD_LEN - 4)) { + err = -EINVAL; + goto err_free; + } urb = usb_alloc_urb(0, GFP_ATOMIC); - if (!urb) - return -ENOMEM; + if (!urb) { + err = -ENOMEM; + goto err_free; + } usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4, @@ -613,6 +620,12 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd, usb_free_urb(urb); return carl9170_usb_submit_cmd_urb(ar); + +err_free: + if (free_buf) + kfree(cmd); + + return err; } int carl9170_exec_cmd(struct ar9170 *ar, const enum carl9170_cmd_oids cmd, |