The code inside rtw_init_drv_sw() calls various init functions to populate the padapter structure and checks for their return values respectively. But if one of the functions in middle fails then it simply returns _FAIL instead of proper logging and calling freeing counterparts of previous init functions. This leads to various memory leaks and can be found in /sys/kernel/debug/kmemleak if kernel is compiled with DEBUG_KMEMLEAK=y. Fix this and keep the success and error separate. Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") Reviewed-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Reviewed-by: Pavel Skripkin <paskripkin@xxxxxxxxx> Signed-off-by: Vihas Makwana <makvihas@xxxxxxxxx> --- Tested on Comfast CF-WU810N RTL8188EUS wireless adapter. --- drivers/staging/r8188eu/os_dep/os_intfs.c | 60 ++++++++++++++++++----- 1 file changed, 47 insertions(+), 13 deletions(-) diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c index 197568422..f59b23dc6 100644 --- a/drivers/staging/r8188eu/os_dep/os_intfs.c +++ b/drivers/staging/r8188eu/os_dep/os_intfs.c @@ -469,32 +469,46 @@ u8 rtw_reset_drv_sw(struct adapter *padapter) u8 rtw_init_drv_sw(struct adapter *padapter) { - if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL) + if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL) { + dev_err(dvobj_to_dev(padapter->dvobj), "rtw_init_cmd_priv failed\n"); return _FAIL; + } padapter->cmdpriv.padapter = padapter; - if ((rtw_init_evt_priv(&padapter->evtpriv)) == _FAIL) - return _FAIL; + if ((rtw_init_evt_priv(&padapter->evtpriv)) == _FAIL) { + dev_err(dvobj_to_dev(padapter->dvobj), "rtw_init_evt_priv failed\n"); + goto free_cmd_priv; + } - if (rtw_init_mlme_priv(padapter) == _FAIL) - return _FAIL; + if (rtw_init_mlme_priv(padapter) == _FAIL) { + dev_err(dvobj_to_dev(padapter->dvobj), "rtw_init_mlme_priv failed\n"); + goto free_evt_priv; + } rtw_init_wifidirect_timers(padapter); init_wifidirect_info(padapter, P2P_ROLE_DISABLE); reset_global_wifidirect_info(padapter); - if (init_mlme_ext_priv(padapter) == _FAIL) - return _FAIL; + if (init_mlme_ext_priv(padapter) == _FAIL) { + dev_err(dvobj_to_dev(padapter->dvobj), "init_mlme_ext_priv failed\n"); + goto free_mlme_priv; + } - if (_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL) - return _FAIL; + if (_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL) { + dev_err(dvobj_to_dev(padapter->dvobj), "_rtw_init_xmit_priv failed\n"); + goto free_mlme_ext; + } - if (_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL) - return _FAIL; + if (_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL) { + dev_err(dvobj_to_dev(padapter->dvobj), "_rtw_init_recv_priv failed\n"); + goto free_xmit_priv; + } - if (_rtw_init_sta_priv(&padapter->stapriv) == _FAIL) - return _FAIL; + if (_rtw_init_sta_priv(&padapter->stapriv) == _FAIL) { + dev_err(dvobj_to_dev(padapter->dvobj), "_rtw_init_sta_priv failed\n"); + goto free_recv_priv; + } padapter->stapriv.padapter = padapter; @@ -510,6 +524,26 @@ u8 rtw_init_drv_sw(struct adapter *padapter) spin_lock_init(&padapter->br_ext_lock); return _SUCCESS; + +free_recv_priv: + _rtw_free_recv_priv(&padapter->recvpriv); + +free_xmit_priv: + _rtw_free_xmit_priv(&padapter->xmitpriv); + +free_mlme_ext: + free_mlme_ext_priv(&padapter->mlmeextpriv); + +free_mlme_priv: + rtw_free_mlme_priv(&padapter->mlmepriv); + +free_evt_priv: + rtw_free_evt_priv(&padapter->evtpriv); + +free_cmd_priv: + rtw_free_cmd_priv(&padapter->cmdpriv); + + return _FAIL; } void rtw_cancel_all_timer(struct adapter *padapter) -- 2.30.2