mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring

commit d10dcb615c8e29d403a24d35f8310a7a53e3050c upstream.

In mwifiex_pcie_init_evt_ring, a new skb is allocated which should be
released if mwifiex_map_pci_memory() fails. The release for skb and
card->evtbd_ring_vbase is added.

Fixes: 0732484b47b5 ("mwifiex: separate ring initialization and ring creation routines")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index f7f1568c4ac817604549c6200bca58dcb80dae93..351dda2fa1ceabcd83b83519bb864158228b4b67 100644 (file)
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -539,8 +539,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
                skb_put(skb, MAX_EVENT_SIZE);
 
                if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
-                                          PCI_DMA_FROMDEVICE))
+                                          PCI_DMA_FROMDEVICE)) {
+                       kfree_skb(skb);
+                       kfree(card->evtbd_ring_vbase);
                        return -1;
+               }
 
                buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);