Commit 09468b03 authored Dec 01, 2011 by Kevin McKinney Committed by Greg Kroah-Hartman Dec 08, 2011

Staging: bcm: Fix double free of 'pReadData' in IOCTL_BCM_NVM_WRITE.



This patch fixes a memory error in ioctl,
IOCTL_BCM_NVM_WRITE. While copying data to
user space, if an error occurs, pReadData
is freed. Then, at the end of the ioctl,
pReadData was being freed again.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

parent 4c6fb5fc

drivers/staging/bcm/Bcmchar.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1336,7 +1336,7 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)

		if (copy_to_user(stNVMReadWrite.pBuffer, pReadData, stNVMReadWrite.uiNumBytes)) {
		kfree(pReadData);
		Status = -EFAULT;
		return -EFAULT;
		}
		} else {
		down(&Adapter->NVMRdmWrmLock);