Merge tag 'rpmsg-v4.14-fixes' of git://github.com/andersson/remoteproc

Pull rpmsg fixes from Bjorn Andersson:
 "This corrects two mistakes in the Qualcomm GLINK SMEM driver"

* tag 'rpmsg-v4.14-fixes' of git://github.com/andersson/remoteproc:
  rpmsg: glink: Fix memory leak in qcom_glink_alloc_intent()
  rpmsg: glink: Unlock on error in qcom_glink_request_intent()

1 files changed, 10 insertions, 4 deletions

diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 5a5e927ea50f..5dcc9bf1c5bc 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -635,19 +635,18 @@ qcom_glink_alloc_intent(struct qcom_glink *glink,
         unsigned long flags;
 
         intent = kzalloc(sizeof(*intent), GFP_KERNEL);
-
         if (!intent)
                 return NULL;
 
         intent->data = kzalloc(size, GFP_KERNEL);
         if (!intent->data)
-                return NULL;
+                goto free_intent;
 
         spin_lock_irqsave(&channel->intent_lock, flags);
         ret = idr_alloc_cyclic(&channel->liids, intent, 1, -1, GFP_ATOMIC);
         if (ret < 0) {
                 spin_unlock_irqrestore(&channel->intent_lock, flags);
-                return NULL;
+                goto free_data;
         }
         spin_unlock_irqrestore(&channel->intent_lock, flags);
 
@@ -656,6 +655,12 @@ qcom_glink_alloc_intent(struct qcom_glink *glink,
         intent->reuse = reuseable;
 
         return intent;
+
+free_data:
+        kfree(intent->data);
+free_intent:
+        kfree(intent);
+        return NULL;
 }
 
 static void qcom_glink_handle_rx_done(struct qcom_glink *glink,
@@ -1197,7 +1202,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,
 
         ret = qcom_glink_tx(glink, &cmd, sizeof(cmd), NULL, 0, true);
         if (ret)
-                return ret;
+                goto unlock;
 
         ret = wait_for_completion_timeout(&channel->intent_req_comp, 10 * HZ);
         if (!ret) {
@@ -1207,6 +1212,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,
                 ret = channel->intent_req_result ? 0 : -ECANCELED;
         }
 
+unlock:
         mutex_unlock(&channel->intent_req_lock);
         return ret;
 }