Commit cf2113ca authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab

[media] uvcvideo: freeing an error pointer

A recent cleanup introduced a potential dereference of -EFAULT when we
call kfree(map->menu_info).

Fixes: 4cc5bed1 ("[media] uvcvideo: Use memdup_user() rather than duplicating its implementation")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent d3d83ee2
...@@ -66,14 +66,14 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, ...@@ -66,14 +66,14 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
if (xmap->menu_count == 0 || if (xmap->menu_count == 0 ||
xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) { xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
ret = -EINVAL; ret = -EINVAL;
goto done; goto free_map;
} }
size = xmap->menu_count * sizeof(*map->menu_info); size = xmap->menu_count * sizeof(*map->menu_info);
map->menu_info = memdup_user(xmap->menu_info, size); map->menu_info = memdup_user(xmap->menu_info, size);
if (IS_ERR(map->menu_info)) { if (IS_ERR(map->menu_info)) {
ret = PTR_ERR(map->menu_info); ret = PTR_ERR(map->menu_info);
goto done; goto free_map;
} }
map->menu_count = xmap->menu_count; map->menu_count = xmap->menu_count;
...@@ -83,13 +83,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, ...@@ -83,13 +83,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type " uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type "
"%u.\n", xmap->v4l2_type); "%u.\n", xmap->v4l2_type);
ret = -ENOTTY; ret = -ENOTTY;
goto done; goto free_map;
} }
ret = uvc_ctrl_add_mapping(chain, map); ret = uvc_ctrl_add_mapping(chain, map);
done:
kfree(map->menu_info); kfree(map->menu_info);
free_map:
kfree(map); kfree(map);
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment