4.2-stable patches

added patches:
	rsi-fix-possible-leak-when-loading-firmware.patch

diff --git a/queue-4.2/rsi-fix-possible-leak-when-loading-firmware.patch b/queue-4.2/rsi-fix-possible-leak-when-loading-firmware.patch
new file mode 100644 (file)
index 0000000..6b7f239
--- /dev/null
+++ b/queue-4.2/rsi-fix-possible-leak-when-loading-firmware.patch
@@ -0,0 +1,73 @@
+From a8b9774571d46506a0774b1ced3493b1245cf893 Mon Sep 17 00:00:00 2001
+From: Christian Engelmayer <cengelma@gmx.at>
+Date: Fri, 21 Aug 2015 23:14:26 +0200
+Subject: rsi: Fix possible leak when loading firmware
+
+From: Christian Engelmayer <cengelma@gmx.at>
+
+commit a8b9774571d46506a0774b1ced3493b1245cf893 upstream.
+
+Commit 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory
+leak fix and fix the leak") also added a check on the allocation of
+DMA-accessible memory that may directly return. In that case the
+already allocated firmware data is leaked. Make sure the data is
+always freed correctly. Detected by Coverity CID 1316519.
+
+Fixes: 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory leak fix and fix the leak")
+Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rsi/rsi_91x_sdio_ops.c |    8 ++++++--
+ drivers/net/wireless/rsi/rsi_91x_usb_ops.c  |    8 ++++++--
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+@@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(stru
+ 
+       /* Copy firmware into DMA-accessible memory */
+       fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+-      if (!fw)
+-              return -ENOMEM;
++      if (!fw) {
++              status = -ENOMEM;
++              goto out;
++      }
+       len = fw_entry->size;
+ 
+       if (len % 4)
+@@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(stru
+ 
+       status = rsi_copy_to_card(common, fw, len, num_blocks);
+       kfree(fw);
++
++out:
+       release_firmware(fw_entry);
+       return status;
+ }
+--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
+@@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(stru
+ 
+       /* Copy firmware into DMA-accessible memory */
+       fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+-      if (!fw)
+-              return -ENOMEM;
++      if (!fw) {
++              status = -ENOMEM;
++              goto out;
++      }
+       len = fw_entry->size;
+ 
+       if (len % 4)
+@@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(stru
+ 
+       status = rsi_copy_to_card(common, fw, len, num_blocks);
+       kfree(fw);
++
++out:
+       release_firmware(fw_entry);
+       return status;
+ }

diff --git a/queue-4.2/series b/queue-4.2/series
index b91d74cceb32639cf2ef51d4c103fee53d08f806..6dedc787b7ed651dd34ab30f3869127e68bde0e2 100644 (file)
--- a/queue-4.2/series
+++ b/queue-4.2/series
@@ -215,3 +215,4 @@ batman-adv-fix-potential-synchronization-issues-in-mcast-tvlv-handler.patch
 batman-adv-fix-potentially-broken-skb-network-header-access.patch
 tools-lib-traceevent-fix-string-handling-in-heterogeneous-arch-environments.patch
 powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch
+rsi-fix-possible-leak-when-loading-firmware.patch