diff options
| author | Dan Carpenter <error27@gmail.com> | 2009-02-21 00:38:46 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-02-21 02:57:49 +0100 |
| commit | b28fe28f2a07ee325834179174a95495d2786561 (patch) | |
| tree | ee886216933e5578dcf9d034a166f183fdf67cc3 /drivers/char/sx.c | |
| parent | sx.c: fix dbl statement if - add missing braces (diff) | |
| download | linux-b28fe28f2a07ee325834179174a95495d2786561.tar.xz linux-b28fe28f2a07ee325834179174a95495d2786561.zip | |
sx.c: avoid referencing freed memory if copy_from_user() fails
The "break" would just result in reusing a free'd pointer. I don't have
the cards myself to test it though. :/
Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to '')
| -rw-r--r-- | drivers/char/sx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/sx.c b/drivers/char/sx.c index d7c416566bd9..518f2a25d91e 100644 --- a/drivers/char/sx.c +++ b/drivers/char/sx.c @@ -1789,7 +1789,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd, nbytes - i : SX_CHUNK_SIZE)) { kfree(tmp); rc = -EFAULT; - break; + goto out; } memcpy_toio(board->base2 + offset + i, tmp, (i + SX_CHUNK_SIZE > nbytes) ? |