From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753453AbcITGv7 (ORCPT ); Tue, 20 Sep 2016 02:51:59 -0400 Received: from mailout1.samsung.com ([203.254.224.24]:40590 "EHLO mailout1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751539AbcITGv5 (ORCPT ); Tue, 20 Sep 2016 02:51:57 -0400 X-AuditID: cbfee61b-f79466d000001e3c-d5-57e0dc849f63 From: Shailendra Verma To: Jarod Wilson , Mauro Carvalho Chehab , Greg Kroah-Hartman , linux-media@vger.kernel.org, devel@driverdev.osuosl.org, Shailendra Verma , Ravikant Sharma Cc: linux-kernel@vger.kernel.org, vidushi.koul@samsung.com Subject: Staging: Media: Lirc - Fix possible ERR_PTR() dereferencing. Date: Tue, 20 Sep 2016 12:21:21 +0530 Message-id: <1474354281-18962-1-git-send-email-shailendra.v@samsung.com> X-Mailer: git-send-email 1.7.9.5 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFuplluLIzCtJLcpLzFFi42I5/e+xoG7LnQfhBke+qFvsOfOL3aJ58Xo2 i6svTjBZXN41h82iZ8NWVovVzyosmhpms1ss+vaK2eLvxUtsDpwe9/YdZvHYP3cNu8eW/rvs Hn1bVjF6fN4k5zH1ZB9rAFsUl01Kak5mWWqRvl0CV8bLY1fZCnbxVLSuaGVvYNzP1cXIySEh YCKxt289M4QtJnHh3nq2LkYuDiGBWYwS375tZoVwXjNKzJvbyghSxSZgKPG67y8TSEJEYAGT RO+kqWwgCWYBK4lJ/2ezgtjCAq4SK25cB2tgEVCV6Jv0B2wFr4CHxM6PT4BqOIDWKUjMmWQz gZF7ASPDKkaJ1ILkguKk9FyjvNRyveLE3OLSvHS95PzcTYzgQHomvYPx8C73Q4wCHIxKPLwB D++HC7EmlhVX5h5ilOBgVhLhNbn+IFyINyWxsiq1KD++qDQntfgQozQHi5I47+P/68KEBNIT S1KzU1MLUotgskwcnFINjHM/b234brnsdlj2inxW0Xzd8gOXz3kw7dp16+fGiilq4vUhR/Xs mhMc1SsfTJPX+1zE+ETs1ITwGWWBljV3vna+mHzq+dOMSE+u7luv/hf+jWqUztr+Lnnau5rI O1ExyozM5k3TxViluiS9lpUuvnOBpyitQNlF2epEx+zl9XqVRndkxWUjlFiKMxINtZiLihMB be2c3yACAAA= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is of course wrong to call kfree() if memdup_user() fails, no memory was allocated and the error in the error-valued pointer should be returned. Reviewed-by: Ravikant Sharma Signed-off-by: Shailendra Verma --- drivers/staging/media/lirc/lirc_imon.c | 7 ++----- drivers/staging/media/lirc/lirc_sasem.c | 7 ++----- 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/drivers/staging/media/lirc/lirc_imon.c b/drivers/staging/media/lirc/lirc_imon.c index 534b810..c21591b 100644 --- a/drivers/staging/media/lirc/lirc_imon.c +++ b/drivers/staging/media/lirc/lirc_imon.c @@ -409,11 +409,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf, } data_buf = memdup_user(buf, n_bytes); - if (IS_ERR(data_buf)) { - retval = PTR_ERR(data_buf); - data_buf = NULL; - goto exit; - } + if (IS_ERR(data_buf)) + return PTR_ERR(data_buf); memcpy(context->tx.data_buf, data_buf, n_bytes); diff --git a/drivers/staging/media/lirc/lirc_sasem.c b/drivers/staging/media/lirc/lirc_sasem.c index f2dca69..ba1ee86 100644 --- a/drivers/staging/media/lirc/lirc_sasem.c +++ b/drivers/staging/media/lirc/lirc_sasem.c @@ -387,11 +387,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf, } data_buf = memdup_user(buf, n_bytes); - if (IS_ERR(data_buf)) { - retval = PTR_ERR(data_buf); - data_buf = NULL; - goto exit; - } + if (IS_ERR(data_buf)) + return PTR_ERR(data_buf); memcpy(context->tx.data_buf, data_buf, n_bytes); -- 1.9.1