[media] uvcvideo: freeing an error pointer

A recent cleanup introduced a potential dereference of -EFAULT when we
call kfree(map->menu_info).

Fixes: 4cc5bed1caeb ("[media] uvcvideo: Use memdup_user() rather than duplicating its implementation")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index a7e12fd20adcc340aae7a28691e0a11489a61b53..3e7e283a44a8e9adfd23e24f0b13bcd8cc6527d9 100644 (file)
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -66,14 +66,14 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
                if (xmap->menu_count == 0 ||
                    xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
                        ret = -EINVAL;
-                       goto done;
+                       goto free_map;
                }
 
                size = xmap->menu_count * sizeof(*map->menu_info);
                map->menu_info = memdup_user(xmap->menu_info, size);
                if (IS_ERR(map->menu_info)) {
                        ret = PTR_ERR(map->menu_info);
-                       goto done;
+                       goto free_map;
                }
 
                map->menu_count = xmap->menu_count;
@@ -83,13 +83,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
                uvc_trace(UVC_TRACE_CONTROL, "Unsupported V4L2 control type "
                          "%u.\n", xmap->v4l2_type);
                ret = -ENOTTY;
-               goto done;
+               goto free_map;
        }
 
        ret = uvc_ctrl_add_mapping(chain, map);
 
-done:
        kfree(map->menu_info);
+free_map:
        kfree(map);
 
        return ret;