aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2009-02-20 18:38:46 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2009-02-20 20:57:49 -0500
commitb28fe28f2a07ee325834179174a95495d2786561 (patch)
treeee886216933e5578dcf9d034a166f183fdf67cc3 /drivers/char
parent9b6d25100ace1dcf9750803ff08f6b61f840be79 (diff)
sx.c: avoid referencing freed memory if copy_from_user() fails
The "break" would just result in reusing a free'd pointer. I don't have the cards myself to test it though. :/ Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/char')
-rw-r--r--drivers/char/sx.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index d7c416566bd9..518f2a25d91e 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1789,7 +1789,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
1789 nbytes - i : SX_CHUNK_SIZE)) { 1789 nbytes - i : SX_CHUNK_SIZE)) {
1790 kfree(tmp); 1790 kfree(tmp);
1791 rc = -EFAULT; 1791 rc = -EFAULT;
1792 break; 1792 goto out;
1793 } 1793 }
1794 memcpy_toio(board->base2 + offset + i, tmp, 1794 memcpy_toio(board->base2 + offset + i, tmp,
1795 (i + SX_CHUNK_SIZE > nbytes) ? 1795 (i + SX_CHUNK_SIZE > nbytes) ?