sx.c: avoid referencing freed memory if copy_from_user() fails
authorDan Carpenter <error27@gmail.com>
Fri, 20 Feb 2009 23:38:46 +0000 (15:38 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Sat, 21 Feb 2009 01:57:49 +0000 (17:57 -0800)
The "break" would just result in reusing a free'd pointer.  I don't have
the cards myself to test it though.  :/

Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/char/sx.c

index d7c416566bd9e6459f963be75f1044d3cbcf96a7..518f2a25d91ec6b1a208c6fe233c505a7395aa47 100644 (file)
@@ -1789,7 +1789,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                                                nbytes - i : SX_CHUNK_SIZE)) {
                                        kfree(tmp);
                                        rc = -EFAULT;
-                                       break;
+                                       goto out;
                                }
                                memcpy_toio(board->base2 + offset + i, tmp,
                                                (i + SX_CHUNK_SIZE > nbytes) ?