[PATCH wireless-next 1/4] wifi: mm81x: free the firmware scratch buffer on parse failures
From: Linmao Li
Date: Wed Aug 12 2026 - 02:12:09 EST
mm81x_fw_load_fw() allocates fw_buf before it inspects the image, but
releases it only on the success path. The two early returns taken for a
malformed image leave one firmware-sized allocation attached to the
device, and mm81x_fw_flash() retries the load three times.
Release it on those paths too, the way mm81x_fw_load_bcf() already does.
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>
---
drivers/net/wireless/morsemicro/mm81x/fw.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/morsemicro/mm81x/fw.c b/drivers/net/wireless/morsemicro/mm81x/fw.c
index d6d2ad086c328..d407b57f4c9cb 100644
--- a/drivers/net/wireless/morsemicro/mm81x/fw.c
+++ b/drivers/net/wireless/morsemicro/mm81x/fw.c
@@ -117,13 +117,15 @@ static int mm81x_fw_load_fw(struct mm81x *mors, const struct firmware *fw)
if (mm81x_fw_get_header(fw->data, &ehdr)) {
dev_err(mors->dev, "Wrong file format");
- return -EINVAL;
+ ret = -EINVAL;
+ goto out_free;
}
if (mm81x_fw_get_section_header(fw->data, &ehdr, &sh_strtab,
ehdr.e_shstrndx)) {
dev_err(mors->dev, "Invalid firmware. Missing string table");
- return -ENOENT;
+ ret = -ENOENT;
+ goto out_free;
}
sh_strs = (const char *)fw->data + sh_strtab.sh_offset;
@@ -179,6 +181,7 @@ static int mm81x_fw_load_fw(struct mm81x *mors, const struct firmware *fw)
if (ehdr.e_entry)
ret = mm81x_fw_set_boot_addr(mors, ehdr.e_entry);
+out_free:
devm_kfree(mors->dev, fw_buf);
return ret;
}
--
2.25.1