brcmsmac: fix memory leak in wlc_phy_attach_lcnphy

[ Upstream commit f4443293d741d1776b86ed1dd8c4e4285d0775fc ]

When wlc_phy_txpwr_srom_read_lcnphy fails in wlc_phy_attach_lcnphy,
the allocated pi->u.pi_lcnphy is leaked, since struct brcms_phy will be
freed in the caller function.

Fix this by calling wlc_phy_detach_lcnphy in the error handler of
wlc_phy_txpwr_srom_read_lcnphy before returning.

Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200908121743.23108-1-keitasuzuki.park@sslab.ics.keio.ac.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
index 9fb0d9fbd93958e11b4eca19428c280a198f5628..d532decc1538321a04bbcad3ab67a702d40363be 100644 (file)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -5085,8 +5085,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
        pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft;
        pi->pi_fptr.detach = wlc_phy_detach_lcnphy;
 
-       if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
+       if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) {
+               kfree(pi->u.pi_lcnphy);
                return false;
+       }
 
        if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
                if (pi_lcn->lcnphy_tempsense_option == 3) {