Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1487102 > unrolled thread
| Started by | Shailendra Verma <shailendra.v@samsung.com> |
|---|---|
| First post | 2016-09-20 09:00 +0200 |
| Last post | 2016-09-20 10:50 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
Staging: Media: Lirc - Fix possible ERR_PTR() dereferencing. Shailendra Verma <shailendra.v@samsung.com> - 2016-09-20 09:00 +0200
Re: Staging: Media: Lirc - Fix possible ERR_PTR() dereferencing. Dan Carpenter <dan.carpenter@oracle.com> - 2016-09-20 10:50 +0200
| From | Shailendra Verma <shailendra.v@samsung.com> |
|---|---|
| Date | 2016-09-20 09:00 +0200 |
| Subject | Staging: Media: Lirc - Fix possible ERR_PTR() dereferencing. |
| Message-ID | <sjnc5-7VS-11@gated-at.bofh.it> |
This is of course wrong to call kfree() if memdup_user() fails,
no memory was allocated and the error in the error-valued pointer
should be returned.
Reviewed-by: Ravikant Sharma <ravikant.s2@samsung.com>
Signed-off-by: Shailendra Verma <shailendra.v@samsung.com>
---
drivers/staging/media/lirc/lirc_imon.c | 7 ++-----
drivers/staging/media/lirc/lirc_sasem.c | 7 ++-----
2 files changed, 4 insertions(+), 10 deletions(-)
diff --git a/drivers/staging/media/lirc/lirc_imon.c b/drivers/staging/media/lirc/lirc_imon.c
index 534b810..c21591b 100644
--- a/drivers/staging/media/lirc/lirc_imon.c
+++ b/drivers/staging/media/lirc/lirc_imon.c
@@ -409,11 +409,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf,
}
data_buf = memdup_user(buf, n_bytes);
- if (IS_ERR(data_buf)) {
- retval = PTR_ERR(data_buf);
- data_buf = NULL;
- goto exit;
- }
+ if (IS_ERR(data_buf))
+ return PTR_ERR(data_buf);
memcpy(context->tx.data_buf, data_buf, n_bytes);
diff --git a/drivers/staging/media/lirc/lirc_sasem.c b/drivers/staging/media/lirc/lirc_sasem.c
index f2dca69..ba1ee86 100644
--- a/drivers/staging/media/lirc/lirc_sasem.c
+++ b/drivers/staging/media/lirc/lirc_sasem.c
@@ -387,11 +387,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf,
}
data_buf = memdup_user(buf, n_bytes);
- if (IS_ERR(data_buf)) {
- retval = PTR_ERR(data_buf);
- data_buf = NULL;
- goto exit;
- }
+ if (IS_ERR(data_buf))
+ return PTR_ERR(data_buf);
memcpy(context->tx.data_buf, data_buf, n_bytes);
--
1.9.1
[toc] | [next] | [standalone]
| From | Dan Carpenter <dan.carpenter@oracle.com> |
|---|---|
| Date | 2016-09-20 10:50 +0200 |
| Message-ID | <sjoUy-Bu-25@gated-at.bofh.it> |
| In reply to | #1487102 |
On Tue, Sep 20, 2016 at 12:21:21PM +0530, Shailendra Verma wrote: > This is of course wrong to call kfree() if memdup_user() fails, > no memory was allocated and the error in the error-valued pointer > should be returned. > > Reviewed-by: Ravikant Sharma <ravikant.s2@samsung.com> > Signed-off-by: Shailendra Verma <shailendra.v@samsung.com> Calling kfree(NULL) is fine so there is no bug in the original code. Also this patch creates a new locking bug. regards, dan carpenter
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web