From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755988AbbBLOAi (ORCPT ); Thu, 12 Feb 2015 09:00:38 -0500 Received: from mx02.posteo.de ([89.146.194.165]:39690 "EHLO mx02.posteo.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753816AbbBLOAe (ORCPT ); Thu, 12 Feb 2015 09:00:34 -0500 Message-ID: <54DCB1FA.1050401@posteo.de> Date: Thu, 12 Feb 2015 15:00:26 +0100 From: Martin Kepplinger User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.4.0 MIME-Version: 1.0 To: Christian Engelmayer , devel@driverdev.osuosl.org CC: gregkh@linuxfoundation.org, forest@alittletooquiet.net, tvboxspy@gmail.com, tapaswenipathak@gmail.com, dan.carpenter@oracle.com, ced@ryick.net, linux-kernel@vger.kernel.org Subject: Re: [PATCH] staging: vt6656: Fix possible leak in vnt_download_firmware() References: <1423683195-12843-1-git-send-email-cengelma@gmx.at> In-Reply-To: <1423683195-12843-1-git-send-email-cengelma@gmx.at> Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Am 2015-02-11 um 20:33 schrieb Christian Engelmayer: > When failing to allocate buffer memory, function vnt_download_firmware() goes > through the wrong exit path and fails to release the already requested > firmware. Thus use the correct cleanup. Detected by Coverity CID 1269128. > > Signed-off-by: Christian Engelmayer > --- > Compile tested only. Applies against branch staging-next. > --- > drivers/staging/vt6656/firmware.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/vt6656/firmware.c b/drivers/staging/vt6656/firmware.c > index a177645af83e..d440f284bf18 100644 > --- a/drivers/staging/vt6656/firmware.c > +++ b/drivers/staging/vt6656/firmware.c > @@ -61,7 +61,7 @@ int vnt_download_firmware(struct vnt_private *priv) > > buffer = kmalloc(FIRMWARE_CHUNK_SIZE, GFP_KERNEL); > if (!buffer) > - goto out; > + goto free_fw; > > for (ii = 0; ii < fw->size; ii += FIRMWARE_CHUNK_SIZE) { > length = min_t(int, fw->size - ii, FIRMWARE_CHUNK_SIZE); > looks good to me, although somebody else should review it too. feel free to add Reviewed-by: Martin Kepplinger if applicable.