diff options
| author |   Dan Williams <dcbw@redhat.com> | 2013-10-14 17:51:55 -0500 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2013-10-18 14:03:54 -0400 |
| commit | 1dfba3060fe7ee03ccec25a91d35085142dfc295 (patch) | |
| tree | c27da4ef59aeaa75b1d39c46af0aeed4f7ba7147 /drivers/net/wireless/libertas/if_cs.c | |
| parent | ath9k: add HT40 spectral scan capability (diff) | |
| download | linux-dev-1dfba3060fe7ee03ccec25a91d35085142dfc295.tar.xz linux-dev-1dfba3060fe7ee03ccec25a91d35085142dfc295.zip | |
libertas: move firmware lifetime handling to firmware.c
Previously, each bus type was responsible for freeing the firmware
structure, but some did that badly. Move responsibility for freeing
firmware into firmware.c so that it's done once and correctly, instead
of happening in multiple places in bus-specific code.
This fixes a use-after-free bug found by Dr. H. Nikolaus Schaller where
the SDIO code forgot to NULL priv->helper_fw after freeing it.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/libertas/if_cs.c')
| -rw-r--r-- | drivers/net/wireless/libertas/if_cs.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c index c94dd6802672..ef8c98e21098 100644 --- a/drivers/net/wireless/libertas/if_cs.c +++ b/drivers/net/wireless/libertas/if_cs.c @@ -754,14 +754,14 @@ static void if_cs_prog_firmware(struct lbs_private *priv, int ret, if (ret == 0 && (card->model != MODEL_8305)) ret = if_cs_prog_real(card, mainfw); if (ret) - goto out; + return; /* Now actually get the IRQ */ ret = request_irq(card->p_dev->irq, if_cs_interrupt, IRQF_SHARED, DRV_NAME, card); if (ret) { pr_err("error in request_irq\n"); - goto out; + return; } /* @@ -777,10 +777,6 @@ static void if_cs_prog_firmware(struct lbs_private *priv, int ret, pr_err("could not activate card\n"); free_irq(card->p_dev->irq, card); } - -out: - release_firmware(helper); - release_firmware(mainfw); } |