staging: rtl8188eu: fix potential leak in rtw_mp_SetRFPath()

Function rtw_mp_SetRFPath() dynamically allocates a temporary buffer that
is not freed in all error paths. Use a centralized exit path and make sure
that all memory is freed correctly. Detected by Coverity - CID 1077714.

Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index 8b1579b..ea5e1f8 100644 (file)
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -7321,11 +7321,14 @@ static int rtw_mp_SetRFPath(struct net_device *dev,
        struct adapter *padapter = rtw_netdev_priv(dev);
        char    *input = kmalloc(wrqu->data.length, GFP_KERNEL);
        u8 bMain = 1, bTurnoff = 1;
+       int ret = 0;
 
        if (!input)
                return -ENOMEM;
-       if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length))
-                       return -EFAULT;
+       if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) {
+               ret = -EFAULT;
+               goto exit;
+       }
        DBG_88E("%s:iwpriv in =%s\n", __func__, input);
 
        bMain = strncmp(input, "1", 2); /*  strncmp true is 0 */
@@ -7338,8 +7341,10 @@ static int rtw_mp_SetRFPath(struct net_device *dev,
                MP_PHY_SetRFPathSwitch(padapter, false);
                DBG_88E("%s:PHY_SetRFPathSwitch = false\n", __func__);
        }
+
+exit:
        kfree(input);
-       return 0;
+       return ret;
 }
 
 static int rtw_mp_QueryDrv(struct net_device *dev,