media: usb: go7007: Fix warning: passing freed memory 'fw'
Subsystems (2)
PATCH 1/1 media: usb: go7007: Fix warning: passing freed memory 'fw'
Fix smatch warning - go7007_loader_probe() warn: passing freed memory 'fw'
The 'fw' pointer is released using release_firmware(fw) and then being used again in another request_firmware() call without being reassigned to a new memory allocation. To resolve it, use separate variables for each request.
--- drivers/media/usb/go7007/go7007-loader.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/media/usb/go7007/go7007-loader.c +7 -7
@@ -35,7 +35,7 @@ static int go7007_loader_probe(struct usb_interface *interface, const struct usb_device_id *id) {struct usb_device *usbdev; -const struct firmware *fw; +const struct firmware *fw_1, *fw_2;u16 vendor, product;const char *fw1, *fw2;int ret;
@@ -67,13 +67,13 @@ static int go7007_loader_probe(struct usb_interface *interface,dev_info (&interface->dev,"loading firmware %s\n" , fw1); -if (request_firmware (&fw, fw1, &usbdev->dev)) { +if (request_firmware (&fw_1, fw1, &usbdev->dev)) {dev_err (&interface->dev,"unable to load firmware from file \"%s\"\n" , fw1); goto failed2; } - ret =cypress_load_firmware (usbdev, fw,CYPRESS_FX2 ); -release_firmware (fw); + ret =cypress_load_firmware (usbdev, fw_1,CYPRESS_FX2 ); +release_firmware (fw_1);if (0 != ret) {dev_err (&interface->dev,"loader download failed\n" ); goto failed2;
@@ -82,13 +82,13 @@ static int go7007_loader_probe(struct usb_interface *interface,if (fw2 ==NULL )return 0 ; -if (request_firmware (&fw, fw2, &usbdev->dev)) { +if (request_firmware (&fw_2, fw2, &usbdev->dev)) {dev_err (&interface->dev,"unable to load firmware from file \"%s\"\n" , fw2); goto failed2; } - ret =cypress_load_firmware (usbdev, fw,CYPRESS_FX2 ); -release_firmware (fw); + ret =cypress_load_firmware (usbdev, fw_2,CYPRESS_FX2 ); +release_firmware (fw_2);if (0 != ret) {dev_err (&interface->dev,"firmware download failed\n" ); goto failed2;
Signature · 1 line
2.25.1
Quoted 5 lines · Madhumitha Prabakaran
Fix smatch warning -
go7007_loader_probe()warn: passing freed memory 'fw'The 'fw' pointer is released using
release_firmware(fw)and then being used again in anotherrequest_firmware()call without being reassigned to a new memory allocation. To resolve it, use separate variables for each request.
Hmm, I don't get this smatch warning. And it doesn't appear to be an actual bug either, so that warning would be a false positive.
I wonder if you tested with an older smatch version?
Regards,
Hans
Quoted 53 lines
Signed-off-by Madhumitha Prabakaran <[email protected]>--- drivers/media/usb/go7007/go7007-loader.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)drivers/media/usb/go7007/go7007-loader.c +7
-7@@ -35,7 +35,7 @@ static int go7007_loader_probe(struct usb_interface *interface, const struct usb_device_id *id) {struct usb_device *usbdev; -const struct firmware *fw; +const struct firmware *fw_1, *fw_2;u16 vendor, product;const char *fw1, *fw2;int ret;@@ -67,13 +67,13 @@ static int go7007_loader_probe(struct usb_interface *interface,dev_info (&interface->dev,"loading firmware %s\n" , fw1); -if (request_firmware (&fw, fw1, &usbdev->dev)) { +if (request_firmware (&fw_1, fw1, &usbdev->dev)) {dev_err (&interface->dev,"unable to load firmware from file \"%s\"\n" , fw1); goto failed2; } - ret =cypress_load_firmware (usbdev, fw,CYPRESS_FX2 ); -release_firmware (fw); + ret =cypress_load_firmware (usbdev, fw_1,CYPRESS_FX2 ); +release_firmware (fw_1);if (0 != ret) {dev_err (&interface->dev,"loader download failed\n" ); goto failed2;@@ -82,13 +82,13 @@ static int go7007_loader_probe(struct usb_interface *interface,if (fw2 ==NULL )return 0 ; -if (request_firmware (&fw, fw2, &usbdev->dev)) { +if (request_firmware (&fw_2, fw2, &usbdev->dev)) {dev_err (&interface->dev,"unable to load firmware from file \"%s\"\n" , fw2); goto failed2; } - ret =cypress_load_firmware (usbdev, fw,CYPRESS_FX2 ); -release_firmware (fw); + ret =cypress_load_firmware (usbdev, fw_2,CYPRESS_FX2 ); +release_firmware (fw_2);if (0 != ret) {dev_err (&interface->dev,"firmware download failed\n" ); goto failed2;