openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

[media] uvcvideo: freeing an error pointer 

A recent cleanup introduced a potential dereference of -EFAULT when we
call kfree(map->menu_info).

Fixes: 4cc5bed1ca ("[media] uvcvideo: Use memdup_user() rather than duplicating its implementation")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Dan Carpenter 2016-11-25 08:28:35 -02:00 committed by Mauro Carvalho Chehab
parent d3d83ee20a
commit cf2113ca56
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/media/usb/uvc/uvc_v4l2.c
View File

@ -66,14 +66,14 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
if (xmap->menu_count == 0 || if (xmap->menu_count == 0 ||
xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) { xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
ret = -EINVAL; ret = -EINVAL;
goto done; goto free_map;
} }
size = xmap->menu_count * sizeof(*map->menu_info); size = xmap->menu_count * sizeof(*map->menu_info);
map->menu_info = memdup_user(xmap->menu_info, size); map->menu_info = memdup_user(xmap->menu_info, size);
if (IS_ERR(map->menu_info)) { if (IS_ERR(map->menu_info)) {
ret = PTR_ERR(map->menu_info); ret = PTR_ERR(map->menu_info);
goto done; goto free_map;
} }
map->menu_count = xmap->menu_count; map->menu_count = xmap->menu_count;
@ -83,13 +83,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type " uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type "
"%u.\n", xmap->v4l2_type); "%u.\n", xmap->v4l2_type);
ret = -ENOTTY; ret = -ENOTTY;
goto done; goto free_map;
} }
ret = uvc_ctrl_add_mapping(chain, map); ret = uvc_ctrl_add_mapping(chain, map);
done:
kfree(map->menu_info); kfree(map->menu_info);
free_map:
kfree(map); kfree(map);
return ret; return ret;