Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b5eed730 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: rtl8712: freeing an ERR_PTR 



If memdup_user() fails then "pparmbuf" is an error pointer and we can't
pass it to kfree().  I changed the "goto _r871x_mp_ioctl_hdl_exit" to a
direct return.

I changed the earlier goto to a direct return as well for consistency
and removed the "pparmbuf = NULL" initializer since it's no longer
needed.

Fixes: 45de4327 ('Staging: rtl8712: Use memdup_user() instead of copy_from_user()')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bb6ce8b2

drivers/staging/rtl8712/rtl871x_ioctl_linux.c

+7 −10
Original line number Diff line number Diff line
@@ -1900,23 +1900,20 @@ static int r871x_mp_ioctl_hdl(struct net_device *dev, 
	struct mp_ioctl_handler *phandler;

	struct mp_ioctl_param *poidparam;

	unsigned long BytesRead, BytesWritten, BytesNeeded;

	u8 *pparmbuf = NULL, bset;

	u8 *pparmbuf, bset;

	u16 len;

	uint status;

	int ret = 0;



	if ((!p->length) || (!p->pointer)) {

		ret = -EINVAL;

		goto _r871x_mp_ioctl_hdl_exit;

	}

	if ((!p->length) || (!p->pointer))

		return -EINVAL;



	bset = (u8)(p->flags & 0xFFFF);

	len = p->length;

	pparmbuf = NULL;

	pparmbuf = memdup_user(p->pointer, len);

	if (IS_ERR(pparmbuf)) {

		ret = PTR_ERR(pparmbuf);

		goto _r871x_mp_ioctl_hdl_exit;

	}

	if (IS_ERR(pparmbuf))

		return PTR_ERR(pparmbuf);



	poidparam = (struct mp_ioctl_param *)pparmbuf;

	if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {

		ret = -EINVAL;