[PATCH] media: drxd: Fix potential firmware copy leak on release

[Guangshuo Li]

load_firmware() copies the firmware into a separately allocated
buffer. drxd_release() only frees the frontend state, losing the
pointer to this copy. Free the microcode before freeing the state.

This issue was found by our static analysis tool under development.

Fixes: 8f19f27e3e0e ("[media] drxd: move firmware to binary blob")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Build-tested the changed object with x86_64 GCC W=1, using defconfig
with the driver dependencies enabled. No hardware/kernel runtime test or full linked-kernel
build.
OpenAI Codex assisted with source review, patch implementation and
commit-message drafting. The submitter has reviewed the changes.

 drivers/media/dvb-frontends/drxd_hard.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/dvb-frontends/drxd_hard.c b/drivers/media/dvb-frontends/drxd_hard.c
index 4d673a108f61..a9e3e43c5b43 100644
--- a/drivers/media/dvb-frontends/drxd_hard.c
+++ b/drivers/media/dvb-frontends/drxd_hard.c
@@ -2870,6 +2870,7 @@ static void drxd_release(struct dvb_frontend *fe)
 {
 	struct drxd_state *state = fe->demodulator_priv;
 
+	kfree(state->microcode);
 	kfree(state);
 }
 

base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d