Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 06ab8b04 authored by Andrzej Pietrasiewicz's avatar Andrzej Pietrasiewicz Committed by Felipe Balbi
Browse files

usb: gadget: uvc: preserve the address passed to kfree() 



__uvcg_fill_strm() called from __uvcg_iter_stream_cls()
might have advanced the "data" even if __uvcg_iter_stream_cls()
returns an error, so use a backup copy as an argument to kfree().

Acked-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent 16272ae7

drivers/usb/gadget/function/uvc_configfs.c

+7 −3
Original line number Original line Diff line number Diff line
@@ -2086,7 +2086,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src, 
	struct mutex *su_mutex = &src->ci_group->cg_subsys->su_mutex;

	struct mutex *su_mutex = &src->ci_group->cg_subsys->su_mutex;

	struct uvc_descriptor_header ***class_array, **cl_arr;

	struct uvc_descriptor_header ***class_array, **cl_arr;

	struct uvcg_streaming_header *target_hdr;

	struct uvcg_streaming_header *target_hdr;

	void *data;

	void *data, *data_save;

	size_t size = 0, count = 0;

	size_t size = 0, count = 0;

	int ret = -EINVAL;

	int ret = -EINVAL;
@@ -2119,7 +2119,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src, 
		goto unlock;

		goto unlock;

	}

	}





	data = kzalloc(size, GFP_KERNEL);

	data = data_save = kzalloc(size, GFP_KERNEL);

	if (!data) {

	if (!data) {

		kfree(*class_array);

		kfree(*class_array);

		*class_array = NULL;

		*class_array = NULL;
@@ -2132,7 +2132,11 @@ static int uvcg_streaming_class_allow_link(struct config_item *src, 
	if (ret) {

	if (ret) {

		kfree(*class_array);

		kfree(*class_array);

		*class_array = NULL;

		*class_array = NULL;

		kfree(data);

		/*

		 * __uvcg_fill_strm() called from __uvcg_iter_stream_cls()

		 * might have advanced the "data", so use a backup copy

		 */

		kfree(data_save);

		goto unlock;

		goto unlock;

	}

	}

	*cl_arr = (struct uvc_descriptor_header *)&opts->uvc_color_matching;

	*cl_arr = (struct uvc_descriptor_header *)&opts->uvc_color_matching;