[PATCH] release_firmware() fixes

Use release_firmware() to free requested resources.

According to Documentation/firmware_class/README the request_firmware()
call should be followed by a release_firmware().  Some drivers do not
however free the firmware previously allocated with request_firmware().
This patch tries to fix this by making sure that release_firmware() is used
as expected.

Signed-off-by: Magnus Damm <magnus@valinux.co.jp>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

7 files changed, 25 insertions, 26 deletions

diff --git a/drivers/bluetooth/bcm203x.c b/drivers/bluetooth/bcm203x.c
index 6f67141f4de0..13ba729cdd57 100644
--- a/drivers/bluetooth/bcm203x.c
+++ b/drivers/bluetooth/bcm203x.c
@@ -234,6 +234,7 @@ static int bcm203x_probe(struct usb_interface *intf, const struct usb_device_id
         data->fw_data = kmalloc(firmware->size, GFP_KERNEL);
         if (!data->fw_data) {
                 BT_ERR("Can't allocate memory for firmware image");
+                release_firmware(firmware);
                 usb_free_urb(data->urb);
                 kfree(data->buffer);
                 kfree(data);
diff --git a/drivers/media/dvb/frontends/nxt200x.c b/drivers/media/dvb/frontends/nxt200x.c
index 55671cb5255e..87c286ee6a00 100644
--- a/drivers/media/dvb/frontends/nxt200x.c
+++ b/drivers/media/dvb/frontends/nxt200x.c
@@ -896,9 +896,9 @@ static int nxt2002_init(struct dvb_frontend* fe)
         }
 
         ret = nxt2002_load_firmware(fe, fw);
+        release_firmware(fw);
         if (ret) {
                 printk("nxt2002: Writing firmware to device failed\n");
-                release_firmware(fw);
                 return ret;
         }
         printk("nxt2002: Firmware upload complete\n");
@@ -960,9 +960,9 @@ static int nxt2004_init(struct dvb_frontend* fe)
         }
 
         ret = nxt2004_load_firmware(fe, fw);
+        release_firmware(fw);
         if (ret) {
                 printk("nxt2004: Writing firmware to device failed\n");
-                release_firmware(fw);
                 return ret;
         }
         printk("nxt2004: Firmware upload complete\n");
diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
index 26bed616fabe..2bf124b53689 100644
--- a/drivers/media/dvb/frontends/or51211.c
+++ b/drivers/media/dvb/frontends/or51211.c
@@ -437,10 +437,10 @@ static int or51211_init(struct dvb_frontend* fe)
                 }
 
                 ret = or51211_load_firmware(fe, fw);
+                release_firmware(fw);
                 if (ret) {
                         printk(KERN_WARNING "or51211: Writing firmware to "
                                "device failed!\n");
-                        release_firmware(fw);
                         return ret;
                 }
                 printk(KERN_INFO "or51211: Firmware upload complete.\n");
diff --git a/drivers/media/dvb/frontends/sp8870.c b/drivers/media/dvb/frontends/sp8870.c
index 44ec5b9a4695..d98fd5c2e13e 100644
--- a/drivers/media/dvb/frontends/sp8870.c
+++ b/drivers/media/dvb/frontends/sp8870.c
@@ -318,7 +318,6 @@ static int sp8870_init (struct dvb_frontend* fe)
         printk("sp8870: waiting for firmware upload (%s)...\n", SP8870_DEFAULT_FIRMWARE);
         if (state->config->request_firmware(fe, &fw, SP8870_DEFAULT_FIRMWARE)) {
                 printk("sp8870: no firmware upload (timeout or file not found?)\n");
-                release_firmware(fw);
                 return -EIO;
         }
 
@@ -327,6 +326,7 @@ static int sp8870_init (struct dvb_frontend* fe)
                 release_firmware(fw);
                 return -EIO;
         }
+        release_firmware(fw);
         printk("sp8870: firmware upload complete\n");
 
         /* enable TS output and interface pins */
diff --git a/drivers/media/dvb/frontends/sp887x.c b/drivers/media/dvb/frontends/sp887x.c
index b0a2b02f6608..5c2f8f4e0ae5 100644
--- a/drivers/media/dvb/frontends/sp887x.c
+++ b/drivers/media/dvb/frontends/sp887x.c
@@ -520,9 +520,9 @@ static int sp887x_init(struct dvb_frontend* fe)
                 }
 
                 ret = sp887x_initial_setup(fe, fw);
+                release_firmware(fw);
                 if (ret) {
                         printk("sp887x: writing firmware to device failed\n");
-                        release_firmware(fw);
                         return ret;
                 }
                 printk("sp887x: firmware upload complete\n");
diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c
index 349632b48e93..b60177f173c3 100644
--- a/drivers/media/video/cx88/cx88-blackbird.c
+++ b/drivers/media/video/cx88/cx88-blackbird.c
@@ -453,11 +453,13 @@ static int blackbird_load_firmware(struct cx8802_dev *dev)
         if (firmware->size != BLACKBIRD_FIRM_IMAGE_SIZE) {
                 dprintk(0, "ERROR: Firmware size mismatch (have %zd, expected %d)\n",
                         firmware->size, BLACKBIRD_FIRM_IMAGE_SIZE);
+                release_firmware(firmware);
                 return -1;
         }
 
         if (0 != memcmp(firmware->data, magic, 8)) {
                 dprintk(0, "ERROR: Firmware magic mismatch, wrong file?\n");
+                release_firmware(firmware);
                 return -1;
         }
 
@@ -478,6 +480,7 @@ static int blackbird_load_firmware(struct cx8802_dev *dev)
         }
         if (checksum) {
                 dprintk(0, "ERROR: Firmware load failed (checksum mismatch).\n");
+                release_firmware(firmware);
                 return -1;
         }
         release_firmware(firmware);
diff --git a/drivers/net/wireless/spectrum_cs.c b/drivers/net/wireless/spectrum_cs.c
index 15465278c789..7f78b7801fb3 100644
--- a/drivers/net/wireless/spectrum_cs.c
+++ b/drivers/net/wireless/spectrum_cs.c
@@ -34,8 +34,6 @@
 
 #include "orinoco.h"
 
-static unsigned char *primsym;
-static unsigned char *secsym;
 static const char primary_fw_name[] = "symbol_sp24t_prim_fw";
 static const char secondary_fw_name[] = "symbol_sp24t_sec_fw";
 
@@ -440,7 +438,7 @@ spectrum_load_blocks(hermes_t *hw, const struct dblock *first_block)
  */
 static int
 spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
-                  const unsigned char *image)
+                  const unsigned char *image, int secondary)
 {
         int ret;
         const unsigned char *ptr;
@@ -455,7 +453,7 @@ spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
         first_block = (const struct dblock *) ptr;
 
         /* Read the PDA */
-        if (image != primsym) {
+        if (secondary) {
                 ret = spectrum_read_pda(hw, pda, sizeof(pda));
                 if (ret)
                         return ret;
@@ -472,7 +470,7 @@ spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
                 return ret;
 
         /* Write the PDA to the adapter */
-        if (image != primsym) {
+        if (secondary) {
                 ret = spectrum_apply_pda(hw, first_block, pda);
                 if (ret)
                         return ret;
@@ -487,7 +485,7 @@ spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
         ret = hermes_init(hw);
 
         /* hermes_reset() should return 0 with the secondary firmware */
-        if (image != primsym && ret != 0)
+        if (secondary && ret != 0)
                 return -ENODEV;
 
         /* And this should work with any firmware */
@@ -509,33 +507,30 @@ spectrum_dl_firmware(hermes_t *hw, struct pcmcia_device *link)
         const struct firmware *fw_entry;
 
         if (request_firmware(&fw_entry, primary_fw_name,
-                             &handle_to_dev(link)) == 0) {
-                primsym = fw_entry->data;
-        } else {
+                             &handle_to_dev(link)) != 0) {
                 printk(KERN_ERR PFX "Cannot find firmware: %s\n",
                        primary_fw_name);
                 return -ENOENT;
         }
 
-        if (request_firmware(&fw_entry, secondary_fw_name,
-                             &handle_to_dev(link)) == 0) {
-                secsym = fw_entry->data;
-        } else {
-                printk(KERN_ERR PFX "Cannot find firmware: %s\n",
-                       secondary_fw_name);
-                return -ENOENT;
-        }
-
         /* Load primary firmware */
-        ret = spectrum_dl_image(hw, link, primsym);
+        ret = spectrum_dl_image(hw, link, fw_entry->data, 0);
+        release_firmware(fw_entry);
         if (ret) {
                 printk(KERN_ERR PFX "Primary firmware download failed\n");
                 return ret;
         }
 
-        /* Load secondary firmware */
-        ret = spectrum_dl_image(hw, link, secsym);
+        if (request_firmware(&fw_entry, secondary_fw_name,
+                             &handle_to_dev(link)) != 0) {
+                printk(KERN_ERR PFX "Cannot find firmware: %s\n",
+                       secondary_fw_name);
+                return -ENOENT;
+        }
 
+        /* Load secondary firmware */
+        ret = spectrum_dl_image(hw, link, fw_entry->data, 1);
+        release_firmware(fw_entry);
         if (ret) {
                 printk(KERN_ERR PFX "Secondary firmware download failed\n");
         }