media: go7007: fix a memleak in go7007_load_encoder

In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
a deallocation thereafter. After the following call chain:

saa7134_go7007_init
  |-> go7007_boot_encoder
        |-> go7007_load_encoder
  |-> kfree(go)

go is freed and thus bounce is leaked.

Fixes: 95ef39403f89 ("[media] go7007: remember boot firmware")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
index 0c24e29..eb03f98 100644 (file)
--- a/drivers/media/usb/go7007/go7007-driver.c
+++ b/drivers/media/usb/go7007/go7007-driver.c
@@ -80,7 +80,7 @@ static int go7007_load_encoder(struct go7007 *go)
        const struct firmware *fw_entry;
        char fw_name[] = "go7007/go7007fw.bin";
        void *bounce;
-       int fw_len, rv = 0;
+       int fw_len;
        u16 intr_val, intr_data;
 
        if (go->boot_fw == NULL) {
@@ -109,9 +109,11 @@ static int go7007_load_encoder(struct go7007 *go)
            go7007_read_interrupt(go, &intr_val, &intr_data) < 0 ||
                        (intr_val & ~0x1) != 0x5a5a) {
                v4l2_err(go, "error transferring firmware\n");
-               rv = -1;
+               kfree(go->boot_fw);
+               go->boot_fw = NULL;
+               return -1;
        }
-       return rv;
+       return 0;
 }
 
 MODULE_FIRMWARE("go7007/go7007fw.bin");