aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2009-02-20 15:38:46 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2009-02-20 17:57:49 -0800
commitb28fe28f2a07ee325834179174a95495d2786561 (patch)
treeee886216933e5578dcf9d034a166f183fdf67cc3
parent9b6d25100ace1dcf9750803ff08f6b61f840be79 (diff)
downloadlinux-2.6.38-lt-ux500-b28fe28f2a07ee325834179174a95495d2786561.tar.gz
sx.c: avoid referencing freed memory if copy_from_user() fails
The "break" would just result in reusing a free'd pointer. I don't have the cards myself to test it though. :/ Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/char/sx.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index d7c416566bd..518f2a25d91 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1789,7 +1789,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
nbytes - i : SX_CHUNK_SIZE)) {
kfree(tmp);
rc = -EFAULT;
- break;
+ goto out;
}
memcpy_toio(board->base2 + offset + i, tmp,
(i + SX_CHUNK_SIZE > nbytes) ?