mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 22:54:01 +00:00
staging: rtl8712: freeing an ERR_PTR
If memdup_user() fails then "pparmbuf" is an error pointer and we can't
pass it to kfree(). I changed the "goto _r871x_mp_ioctl_hdl_exit" to a
direct return.
I changed the earlier goto to a direct return as well for consistency
and removed the "pparmbuf = NULL" initializer since it's no longer
needed.
Fixes: 45de432775
('Staging: rtl8712: Use memdup_user() instead of copy_from_user()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
bb6ce8b28d
commit
b5eed730bd
1 changed files with 7 additions and 10 deletions
|
@ -1900,23 +1900,20 @@ static int r871x_mp_ioctl_hdl(struct net_device *dev,
|
||||||
struct mp_ioctl_handler *phandler;
|
struct mp_ioctl_handler *phandler;
|
||||||
struct mp_ioctl_param *poidparam;
|
struct mp_ioctl_param *poidparam;
|
||||||
unsigned long BytesRead, BytesWritten, BytesNeeded;
|
unsigned long BytesRead, BytesWritten, BytesNeeded;
|
||||||
u8 *pparmbuf = NULL, bset;
|
u8 *pparmbuf, bset;
|
||||||
u16 len;
|
u16 len;
|
||||||
uint status;
|
uint status;
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
|
|
||||||
if ((!p->length) || (!p->pointer)) {
|
if ((!p->length) || (!p->pointer))
|
||||||
ret = -EINVAL;
|
return -EINVAL;
|
||||||
goto _r871x_mp_ioctl_hdl_exit;
|
|
||||||
}
|
|
||||||
bset = (u8)(p->flags & 0xFFFF);
|
bset = (u8)(p->flags & 0xFFFF);
|
||||||
len = p->length;
|
len = p->length;
|
||||||
pparmbuf = NULL;
|
|
||||||
pparmbuf = memdup_user(p->pointer, len);
|
pparmbuf = memdup_user(p->pointer, len);
|
||||||
if (IS_ERR(pparmbuf)) {
|
if (IS_ERR(pparmbuf))
|
||||||
ret = PTR_ERR(pparmbuf);
|
return PTR_ERR(pparmbuf);
|
||||||
goto _r871x_mp_ioctl_hdl_exit;
|
|
||||||
}
|
|
||||||
poidparam = (struct mp_ioctl_param *)pparmbuf;
|
poidparam = (struct mp_ioctl_param *)pparmbuf;
|
||||||
if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
|
if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
|
||||||
ret = -EINVAL;
|
ret = -EINVAL;
|
||||||
|
|
Loading…
Reference in a new issue