Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b28fe28f authored by Dan Carpenter's avatar Dan Carpenter Committed by Linus Torvalds
Browse files

sx.c: avoid referencing freed memory if copy_from_user() fails 



The "break" would just result in reusing a free'd pointer.  I don't have
the cards myself to test it though.  :/

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 9b6d2510

drivers/char/sx.c

+1 −1
Original line number Diff line number Diff line
@@ -1789,7 +1789,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd, 
						nbytes - i : SX_CHUNK_SIZE)) {

					kfree(tmp);

					rc = -EFAULT;

					break;

					goto out;

				}

				memcpy_toio(board->base2 + offset + i, tmp,

						(i + SX_CHUNK_SIZE > nbytes) ?