When kmemdup() returns NULL to ta_firmware, no error return code of
rsi_load_9116_firmware() is assigned.
To fix this bug, status is assigned with -ENOMEM in this case.

Reported-by: TOTE Robot <os...@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1...@gmail.com>
---
 drivers/net/wireless/rsi/rsi_91x_hal.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c 
b/drivers/net/wireless/rsi/rsi_91x_hal.c
index ce9892152f4d..32ecb8b3d6c5 100644
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -1038,8 +1038,10 @@ static int rsi_load_9116_firmware(struct rsi_hw *adapter)
        }
 
        ta_firmware = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
-       if (!ta_firmware)
+       if (!ta_firmware) {
+               status = -ENOMEM;
                goto fail_release_fw;
+       }
        fw_p = ta_firmware;
        instructions_sz = fw_entry->size;
        rsi_dbg(INFO_ZONE, "FW Length = %d bytes\n", instructions_sz);
-- 
2.17.1

Reply via email to