From cf2113ca563191a9ee5943561827e50ad8cda4e0 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 25 Nov 2016 08:28:35 -0200 Subject: [PATCH] [media] uvcvideo: freeing an error pointer A recent cleanup introduced a potential dereference of -EFAULT when we call kfree(map->menu_info). Fixes: 4cc5bed1caeb ("[media] uvcvideo: Use memdup_user() rather than duplicating its implementation") Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/uvc/uvc_v4l2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index a7e12fd20adc..3e7e283a44a8 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -66,14 +66,14 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, if (xmap->menu_count == 0 || xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) { ret = -EINVAL; - goto done; + goto free_map; } size = xmap->menu_count * sizeof(*map->menu_info); map->menu_info = memdup_user(xmap->menu_info, size); if (IS_ERR(map->menu_info)) { ret = PTR_ERR(map->menu_info); - goto done; + goto free_map; } map->menu_count = xmap->menu_count; @@ -83,13 +83,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type " "%u.\n", xmap->v4l2_type); ret = -ENOTTY; - goto done; + goto free_map; } ret = uvc_ctrl_add_mapping(chain, map); -done: kfree(map->menu_info); +free_map: kfree(map); return ret; -- 2.39.5