From: Greg Kroah-Hartman Date: Sat, 17 Oct 2015 23:42:35 +0000 (-0700) Subject: 4.2-stable patches X-Git-Tag: v3.10.91~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7711f301a4efe3cc39f1e5c18f9e58d04ad65d71;p=thirdparty%2Fkernel%2Fstable-queue.git 4.2-stable patches added patches: rsi-fix-possible-leak-when-loading-firmware.patch --- diff --git a/queue-4.2/rsi-fix-possible-leak-when-loading-firmware.patch b/queue-4.2/rsi-fix-possible-leak-when-loading-firmware.patch new file mode 100644 index 00000000000..6b7f239ac83 --- /dev/null +++ b/queue-4.2/rsi-fix-possible-leak-when-loading-firmware.patch @@ -0,0 +1,73 @@ +From a8b9774571d46506a0774b1ced3493b1245cf893 Mon Sep 17 00:00:00 2001 +From: Christian Engelmayer +Date: Fri, 21 Aug 2015 23:14:26 +0200 +Subject: rsi: Fix possible leak when loading firmware + +From: Christian Engelmayer + +commit a8b9774571d46506a0774b1ced3493b1245cf893 upstream. + +Commit 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory +leak fix and fix the leak") also added a check on the allocation of +DMA-accessible memory that may directly return. In that case the +already allocated firmware data is leaked. Make sure the data is +always freed correctly. Detected by Coverity CID 1316519. + +Fixes: 5d5cd85ff441 ("rsi: Fix failure to load firmware after memory leak fix and fix the leak") +Signed-off-by: Christian Engelmayer +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 8 ++++++-- + drivers/net/wireless/rsi/rsi_91x_usb_ops.c | 8 ++++++-- + 2 files changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c +@@ -203,8 +203,10 @@ static int rsi_load_ta_instructions(stru + + /* Copy firmware into DMA-accessible memory */ + fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); +- if (!fw) +- return -ENOMEM; ++ if (!fw) { ++ status = -ENOMEM; ++ goto out; ++ } + len = fw_entry->size; + + if (len % 4) +@@ -217,6 +219,8 @@ static int rsi_load_ta_instructions(stru + + status = rsi_copy_to_card(common, fw, len, num_blocks); + kfree(fw); ++ ++out: + release_firmware(fw_entry); + return status; + } +--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c +@@ -148,8 +148,10 @@ static int rsi_load_ta_instructions(stru + + /* Copy firmware into DMA-accessible memory */ + fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); +- if (!fw) +- return -ENOMEM; ++ if (!fw) { ++ status = -ENOMEM; ++ goto out; ++ } + len = fw_entry->size; + + if (len % 4) +@@ -162,6 +164,8 @@ static int rsi_load_ta_instructions(stru + + status = rsi_copy_to_card(common, fw, len, num_blocks); + kfree(fw); ++ ++out: + release_firmware(fw_entry); + return status; + } diff --git a/queue-4.2/series b/queue-4.2/series index b91d74cceb3..6dedc787b7e 100644 --- a/queue-4.2/series +++ b/queue-4.2/series @@ -215,3 +215,4 @@ batman-adv-fix-potential-synchronization-issues-in-mcast-tvlv-handler.patch batman-adv-fix-potentially-broken-skb-network-header-access.patch tools-lib-traceevent-fix-string-handling-in-heterogeneous-arch-environments.patch powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch +rsi-fix-possible-leak-when-loading-firmware.patch