diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2016-11-25 08:28:35 -0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2016-11-29 12:05:00 -0200 |
| commit | cf2113ca563191a9ee5943561827e50ad8cda4e0 (patch) | |
| tree | 410516aef7ad66be6580a727320d493a7ba42fe7 /drivers/media/usb/uvc | |
| parent | d3d83ee20afda16ad0133ba00f63c11a8d842a35 (diff) | |
| download | linux-cf2113ca563191a9ee5943561827e50ad8cda4e0.tar.gz linux-cf2113ca563191a9ee5943561827e50ad8cda4e0.tar.bz2 linux-cf2113ca563191a9ee5943561827e50ad8cda4e0.zip | |
[media] uvcvideo: freeing an error pointer
A recent cleanup introduced a potential dereference of -EFAULT when we
call kfree(map->menu_info).
Fixes: 4cc5bed1caeb ("[media] uvcvideo: Use memdup_user() rather than duplicating its implementation")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/usb/uvc')
| -rw-r--r-- | drivers/media/usb/uvc/uvc_v4l2.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index a7e12fd20adc..3e7e283a44a8 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -66,14 +66,14 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, if (xmap->menu_count == 0 || xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) { ret = -EINVAL; - goto done; + goto free_map; } size = xmap->menu_count * sizeof(*map->menu_info); map->menu_info = memdup_user(xmap->menu_info, size); if (IS_ERR(map->menu_info)) { ret = PTR_ERR(map->menu_info); - goto done; + goto free_map; } map->menu_count = xmap->menu_count; @@ -83,13 +83,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type " "%u.\n", xmap->v4l2_type); ret = -ENOTTY; - goto done; + goto free_map; } ret = uvc_ctrl_add_mapping(chain, map); -done: kfree(map->menu_info); +free_map: kfree(map); return ret; |