Commit 4bff7208 authored by Tomas Winkler's avatar Tomas Winkler Committed by Greg Kroah-Hartman

mei: nfc: fix memory leak in error path

The flow may reach the err label without freeing cl and cl_info

cl and cl_info weren't assigned to ndev->cl and cl_info
so they weren't freed in mei_nfc_free called on error path

Cc: <stable@vger.kernel.org> # 3.10+
Cc: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9ae113ce
...@@ -485,8 +485,11 @@ int mei_nfc_host_init(struct mei_device *dev) ...@@ -485,8 +485,11 @@ int mei_nfc_host_init(struct mei_device *dev)
if (ndev->cl_info) if (ndev->cl_info)
return 0; return 0;
cl_info = mei_cl_allocate(dev); ndev->cl_info = mei_cl_allocate(dev);
cl = mei_cl_allocate(dev); ndev->cl = mei_cl_allocate(dev);
cl = ndev->cl;
cl_info = ndev->cl_info;
if (!cl || !cl_info) { if (!cl || !cl_info) {
ret = -ENOMEM; ret = -ENOMEM;
...@@ -527,10 +530,9 @@ int mei_nfc_host_init(struct mei_device *dev) ...@@ -527,10 +530,9 @@ int mei_nfc_host_init(struct mei_device *dev)
cl->device_uuid = mei_nfc_guid; cl->device_uuid = mei_nfc_guid;
list_add_tail(&cl->device_link, &dev->device_list); list_add_tail(&cl->device_link, &dev->device_list);
ndev->cl_info = cl_info;
ndev->cl = cl;
ndev->req_id = 1; ndev->req_id = 1;
INIT_WORK(&ndev->init_work, mei_nfc_init); INIT_WORK(&ndev->init_work, mei_nfc_init);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment