Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-09 22:50:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

sx.c: avoid referencing freed memory if copy_from_user() fails

Browse Source 
The "break" would just result in reusing a free'd pointer.  I don't have
the cards myself to test it though.  :/

Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Dan Carpenter 2009-02-20 15:38:46 -08:00 committed by Linus Torvalds
parent 9b6d25100a
commit b28fe28f2a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/char/sx.c
View File

@ -1789,7 +1789,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
nbytes - i : SX_CHUNK_SIZE)) { nbytes - i : SX_CHUNK_SIZE)) {
kfree(tmp); kfree(tmp);
rc = -EFAULT; rc = -EFAULT;
break; goto out;
} }
memcpy_toio(board->base2 + offset + i, tmp, memcpy_toio(board->base2 + offset + i, tmp,
(i + SX_CHUNK_SIZE > nbytes) ? (i + SX_CHUNK_SIZE > nbytes) ?