soc: qcom: wcnss_ctrl: fix firmware leak on req allocation failure

[PATCH] soc: qcom: wcnss_ctrl: fix firmware leak on req allocation failure

Posted by Felix Gu 1 month, 4 weeks ago

In wcnss_download_nv(), if kzalloc_flex() fails, the current code
returns -ENOMEM directly and leaves the firmware reference unreleased.

Fixes: 908061f0ad30 ("soc: qcom: wcnss: simplify allocation of req")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/soc/qcom/wcnss_ctrl.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/soc/qcom/wcnss_ctrl.c b/drivers/soc/qcom/wcnss_ctrl.c
index ffb31a049d4a..f046d0248306 100644
--- a/drivers/soc/qcom/wcnss_ctrl.c
+++ b/drivers/soc/qcom/wcnss_ctrl.c
@@ -221,8 +221,10 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc)
 	left = fw->size;
 
 	req = kzalloc_flex(*req, fragment, NV_FRAGMENT_SIZE);
-	if (!req)
-		return -ENOMEM;
+	if (!req) {
+		ret = -ENOMEM;
+		goto release_fw;
+	}
 
 	req->frag_size = NV_FRAGMENT_SIZE;
 	req->hdr.type = WCNSS_DOWNLOAD_NV_REQ;
@@ -243,7 +245,7 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc)
 		ret = rpmsg_send(wcnss->channel, req, req->hdr.len);
 		if (ret < 0) {
 			dev_err(dev, "failed to send smd packet\n");
-			goto release_fw;
+			goto free_req;
 		}
 
 		/* Increment for next fragment */
@@ -262,9 +264,10 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc)
 		ret = 0;
 	}
 
+free_req:
+	kfree(req);
 release_fw:
 	release_firmware(fw);
-	kfree(req);
 
 	return ret;
 }

---
base-commit: 452c3b1ea875276105ac90ba474f72b4cd9b77a2
change-id: 20260417-wcnss_ctrl-43783099258e

Best regards,
-- 
Felix Gu <ustc.gu@gmail.com>

Re: [PATCH] soc: qcom: wcnss_ctrl: fix firmware leak on req allocation failure

Posted by Dmitry Baryshkov 1 month, 4 weeks ago

On Fri, Apr 17, 2026 at 09:17:52PM +0800, Felix Gu wrote:
> In wcnss_download_nv(), if kzalloc_flex() fails, the current code
> returns -ENOMEM directly and leaves the firmware reference unreleased.
> 
> Fixes: 908061f0ad30 ("soc: qcom: wcnss: simplify allocation of req")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> ---
>  drivers/soc/qcom/wcnss_ctrl.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

> 
-- 
With best wishes
Dmitry

Re: [PATCH] soc: qcom: wcnss_ctrl: fix firmware leak on req allocation failure

Posted by Rosen Penev 1 month, 4 weeks ago

On Fri, Apr 17, 2026 at 3:56 PM Dmitry Baryshkov
<dmitry.baryshkov@oss.qualcomm.com> wrote:
>
> On Fri, Apr 17, 2026 at 09:17:52PM +0800, Felix Gu wrote:
> > In wcnss_download_nv(), if kzalloc_flex() fails, the current code
> > returns -ENOMEM directly and leaves the firmware reference unreleased.
> >
> > Fixes: 908061f0ad30 ("soc: qcom: wcnss: simplify allocation of req")
> > Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Same as
https://lore.kernel.org/linux-arm-msm/20260407221519.6824-1-rosenp@gmail.com/
> > ---
> >  drivers/soc/qcom/wcnss_ctrl.c | 11 +++++++----
> >  1 file changed, 7 insertions(+), 4 deletions(-)
>
> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
>
> >
> --
> With best wishes
> Dmitry

Re: [PATCH] soc: qcom: wcnss_ctrl: fix firmware leak on req allocation failure

Posted by Dmitry Baryshkov 1 month, 4 weeks ago

On Fri, Apr 17, 2026 at 04:25:38PM -0700, Rosen Penev wrote:
> On Fri, Apr 17, 2026 at 3:56 PM Dmitry Baryshkov
> <dmitry.baryshkov@oss.qualcomm.com> wrote:
> >
> > On Fri, Apr 17, 2026 at 09:17:52PM +0800, Felix Gu wrote:
> > > In wcnss_download_nv(), if kzalloc_flex() fails, the current code
> > > returns -ENOMEM directly and leaves the firmware reference unreleased.
> > >
> > > Fixes: 908061f0ad30 ("soc: qcom: wcnss: simplify allocation of req")
> > > Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> Same as
> https://lore.kernel.org/linux-arm-msm/20260407221519.6824-1-rosenp@gmail.com/

Indeed!

> > > ---
> > >  drivers/soc/qcom/wcnss_ctrl.c | 11 +++++++----
> > >  1 file changed, 7 insertions(+), 4 deletions(-)
> >
> > Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> >
> > >
> > --
> > With best wishes
> > Dmitry

-- 
With best wishes
Dmitry