mm81x_fw_load_fw() allocates fw_buf before it inspects the image, but releases it only on the success path. The two early returns taken for a malformed image leave one firmware-sized allocation attached to the device, and mm81x_fw_flash() retries the load three times. Release it on those paths too, the way mm81x_fw_load_bcf() already does. Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver") Signed-off-by: Linmao Li --- drivers/net/wireless/morsemicro/mm81x/fw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/morsemicro/mm81x/fw.c b/drivers/net/wireless/morsemicro/mm81x/fw.c index d6d2ad086c328..d407b57f4c9cb 100644 --- a/drivers/net/wireless/morsemicro/mm81x/fw.c +++ b/drivers/net/wireless/morsemicro/mm81x/fw.c @@ -117,13 +117,15 @@ static int mm81x_fw_load_fw(struct mm81x *mors, const struct firmware *fw) if (mm81x_fw_get_header(fw->data, &ehdr)) { dev_err(mors->dev, "Wrong file format"); - return -EINVAL; + ret = -EINVAL; + goto out_free; } if (mm81x_fw_get_section_header(fw->data, &ehdr, &sh_strtab, ehdr.e_shstrndx)) { dev_err(mors->dev, "Invalid firmware. Missing string table"); - return -ENOENT; + ret = -ENOENT; + goto out_free; } sh_strs = (const char *)fw->data + sh_strtab.sh_offset; @@ -179,6 +181,7 @@ static int mm81x_fw_load_fw(struct mm81x *mors, const struct firmware *fw) if (ehdr.e_entry) ret = mm81x_fw_set_boot_addr(mors, ehdr.e_entry); +out_free: devm_kfree(mors->dev, fw_buf); return ret; } -- 2.25.1