diff options
| author | Dan Carpenter | 2009-02-20 15:38:46 -0800 |
|---|---|---|
| committer | Linus Torvalds | 2009-02-20 17:57:49 -0800 |
| commit | b28fe28f2a07ee325834179174a95495d2786561 (patch) | |
| tree | ee886216933e5578dcf9d034a166f183fdf67cc3 | |
| parent | 9b6d25100ace1dcf9750803ff08f6b61f840be79 (diff) | |
sx.c: avoid referencing freed memory if copy_from_user() fails
The "break" would just result in reusing a free'd pointer. I don't have
the cards myself to test it though. :/
Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | drivers/char/sx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/sx.c b/drivers/char/sx.c index d7c416566bd9..518f2a25d91e 100644 --- a/drivers/char/sx.c +++ b/drivers/char/sx.c @@ -1789,7 +1789,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd, nbytes - i : SX_CHUNK_SIZE)) { kfree(tmp); rc = -EFAULT; - break; + goto out; } memcpy_toio(board->base2 + offset + i, tmp, (i + SX_CHUNK_SIZE > nbytes) ? |