[PATCH wireless-next 1/4] wifi: mm81x: free the firmware scratch buffer on parse failures

mm81x_fw_load_fw() allocates fw_buf before it inspects the image, but
releases it only on the success path.  The two early returns taken for a
malformed image leave one firmware-sized allocation attached to the
device, and mm81x_fw_flash() retries the load three times.

Release it on those paths too, the way mm81x_fw_load_bcf() already does.

Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Linmao Li <[email protected]>
---
 drivers/net/wireless/morsemicro/mm81x/fw.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/morsemicro/mm81x/fw.c b/drivers/net/wireless/morsemicro/mm81x/fw.c
index d6d2ad086c328..d407b57f4c9cb 100644
--- a/drivers/net/wireless/morsemicro/mm81x/fw.c
+++ b/drivers/net/wireless/morsemicro/mm81x/fw.c
@@ -117,13 +117,15 @@ static int mm81x_fw_load_fw(struct mm81x *mors, const struct firmware *fw)
 
 	if (mm81x_fw_get_header(fw->data, &ehdr)) {
 		dev_err(mors->dev, "Wrong file format");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_free;
 	}
 
 	if (mm81x_fw_get_section_header(fw->data, &ehdr, &sh_strtab,
 					ehdr.e_shstrndx)) {
 		dev_err(mors->dev, "Invalid firmware. Missing string table");
-		return -ENOENT;
+		ret = -ENOENT;
+		goto out_free;
 	}
 
 	sh_strs = (const char *)fw->data + sh_strtab.sh_offset;
@@ -179,6 +181,7 @@ static int mm81x_fw_load_fw(struct mm81x *mors, const struct firmware *fw)
 	if (ehdr.e_entry)
 		ret = mm81x_fw_set_boot_addr(mors, ehdr.e_entry);
 
+out_free:
 	devm_kfree(mors->dev, fw_buf);
 	return ret;
 }
-- 
2.25.1