Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf2113ca authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

[media] uvcvideo: freeing an error pointer 



A recent cleanup introduced a potential dereference of -EFAULT when we
call kfree(map->menu_info).

Fixes: 4cc5bed1 ("[media] uvcvideo: Use memdup_user() rather than duplicating its implementation")

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent d3d83ee2

drivers/media/usb/uvc/uvc_v4l2.c

+4 −4
Original line number Diff line number Diff line
@@ -66,14 +66,14 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, 
		if (xmap->menu_count == 0 ||

		    xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {

			ret = -EINVAL;

			goto done;

			goto free_map;

		}



		size = xmap->menu_count * sizeof(*map->menu_info);

		map->menu_info = memdup_user(xmap->menu_info, size);

		if (IS_ERR(map->menu_info)) {

			ret = PTR_ERR(map->menu_info);

			goto done;

			goto free_map;

		}



		map->menu_count = xmap->menu_count;
@@ -83,13 +83,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, 
		uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type "

			  "%u.\n", xmap->v4l2_type);

		ret = -ENOTTY;

		goto done;

		goto free_map;

	}



	ret = uvc_ctrl_add_mapping(chain, map);



done:

	kfree(map->menu_info);

free_map:

	kfree(map);



	return ret;