aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <[email protected]>2016-11-25 08:28:35 -0200
committerMauro Carvalho Chehab <[email protected]>2016-11-29 12:05:00 -0200
commitcf2113ca563191a9ee5943561827e50ad8cda4e0 (patch)
tree410516aef7ad66be6580a727320d493a7ba42fe7
parentd3d83ee20afda16ad0133ba00f63c11a8d842a35 (diff)
[media] uvcvideo: freeing an error pointer
A recent cleanup introduced a potential dereference of -EFAULT when we call kfree(map->menu_info). Fixes: 4cc5bed1caeb ("[media] uvcvideo: Use memdup_user() rather than duplicating its implementation") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
-rw-r--r--drivers/media/usb/uvc/uvc_v4l2.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index a7e12fd20adc..3e7e283a44a8 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -66,14 +66,14 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
if (xmap->menu_count == 0 ||
xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
ret = -EINVAL;
- goto done;
+ goto free_map;
}
size = xmap->menu_count * sizeof(*map->menu_info);
map->menu_info = memdup_user(xmap->menu_info, size);
if (IS_ERR(map->menu_info)) {
ret = PTR_ERR(map->menu_info);
- goto done;
+ goto free_map;
}
map->menu_count = xmap->menu_count;
@@ -83,13 +83,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type "
"%u.\n", xmap->v4l2_type);
ret = -ENOTTY;
- goto done;
+ goto free_map;
}
ret = uvc_ctrl_add_mapping(chain, map);
-done:
kfree(map->menu_info);
+free_map:
kfree(map);
return ret;