media: go7007: fix a memleak in go7007_load_encoder

[ Upstream commit b9b683844b01d171a72b9c0419a2d760d946ee12 ]

In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
a deallocation thereafter. After the following call chain:

saa7134_go7007_init
  |-> go7007_boot_encoder
        |-> go7007_load_encoder
  |-> kfree(go)

go is freed and thus bounce is leaked.

Fixes: 95ef39403f89 ("[media] go7007: remember boot firmware")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
index c7b5a3321cd7495eea113896efe5ae7866affaf3..15f78d3ce3bac66d743c2742830b90debcefa75f 100644 (file)
--- a/drivers/media/usb/go7007/go7007-driver.c
+++ b/drivers/media/usb/go7007/go7007-driver.c
@@ -88,7 +88,7 @@ static int go7007_load_encoder(struct go7007 *go)
        const struct firmware *fw_entry;
        char fw_name[] = "go7007/go7007fw.bin";
        void *bounce;
-       int fw_len, rv = 0;
+       int fw_len;
        u16 intr_val, intr_data;
 
        if (go->boot_fw == NULL) {
@@ -117,9 +117,11 @@ static int go7007_load_encoder(struct go7007 *go)
            go7007_read_interrupt(go, &intr_val, &intr_data) < 0 ||
                        (intr_val & ~0x1) != 0x5a5a) {
                v4l2_err(go, "error transferring firmware\n");
-               rv = -1;
+               kfree(go->boot_fw);
+               go->boot_fw = NULL;
+               return -1;
        }
-       return rv;
+       return 0;
 }
 
 MODULE_FIRMWARE("go7007/go7007fw.bin");