Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aea253ec authored by Vladimir Motyka's avatar Vladimir Motyka Committed by Chris Ball
Browse files

mmc: card: fix potential null dereference of 'idata' 



When allocation of idata failed there was a null dereference. Also avoid
calling kfree where it isn't needed.

Signed-off-by: default avatarVladimir Motyka <vladimir.motyka@gmail.com>
Signed-off-by: default avatarChris Ball <cjb@laptop.org>
parent cf2b5eea

drivers/mmc/card/block.c

+6 −5
Original line number Diff line number Diff line
@@ -237,24 +237,24 @@ static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user( 
	idata = kzalloc(sizeof(*idata), GFP_KERNEL);

	if (!idata) {

		err = -ENOMEM;

		goto copy_err;

		goto out;

	}



	if (copy_from_user(&idata->ic, user, sizeof(idata->ic))) {

		err = -EFAULT;

		goto copy_err;

		goto idata_err;

	}



	idata->buf_bytes = (u64) idata->ic.blksz * idata->ic.blocks;

	if (idata->buf_bytes > MMC_IOC_MAX_BYTES) {

		err = -EOVERFLOW;

		goto copy_err;

		goto idata_err;

	}



	idata->buf = kzalloc(idata->buf_bytes, GFP_KERNEL);

	if (!idata->buf) {

		err = -ENOMEM;

		goto copy_err;

		goto idata_err;

	}



	if (copy_from_user(idata->buf, (void __user *)(unsigned long)
@@ -267,9 +267,10 @@ static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user( 


copy_err:

	kfree(idata->buf);

idata_err:

	kfree(idata);

out:

	return ERR_PTR(err);



}



static int mmc_blk_ioctl_cmd(struct block_device *bdev,