Skip to contentSkip to conversation

mtip32xx: calling kfree() on an error pointer

PATCH In review Dan Carpenter 2 participants 4 messages Jan 6, 2016

Subsystems (2)
Block layer Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 mtip32xx: calling kfree() on an error pointer

If memdup_user() fails then we end up passing an ERR_PTR to kfree() which is a bug.

Fixes 85b4d87c9962 ('mtip32xx: don't open-code memdup_user()')
Signed-off-by Dan Carpenter <[email protected]>
drivers/block/mtip32xx/mtip32xx.c +2 -0
index 618c24f..15bec40 100644
@@ -2032,6 +2032,7 @@ static int exec_drive_taskfile(struct driver_data *dd,
 		outbuf = memdup_user(buf + outtotal, taskout);
 		if (IS_ERR(outbuf)) {
 			err = PTR_ERR(outbuf);
+			outbuf = NULL;
 			goto abort;
 		}
 		outbuf_dma = pci_map_single(dd->pdev,

@@ -2049,6 +2050,7 @@ static int exec_drive_taskfile(struct driver_data *dd,
 		inbuf = memdup_user(buf + intotal, taskin);
 		if (IS_ERR(inbuf)) {
 			err = PTR_ERR(inbuf);
+			inbuf = NULL;
 			goto abort;
 		}
 		inbuf_dma = pci_map_single(dd->pdev,
#1 lore raw
Quoted 2 lines · Dan Carpenter

If memdup_user() fails then we end up passing an ERR_PTR to kfree() which is a bug.

Mind if I fold it (with credit, obviously)?

author
#2 lore raw
Quoted 5 lines · Al Viro
Quoted 2 lines · Dan Carpenter

If memdup_user() fails then we end up passing an ERR_PTR to kfree() which is a bug.

Mind if I fold it (with credit, obviously)?

No problem, that's fine.

regards,
dan carpenter

#3 lore raw
Quoted 8 lines · Dan Carpenter
Quoted 5 lines · Al Viro
Quoted 2 lines · Dan Carpenter

If memdup_user() fails then we end up passing an ERR_PTR to kfree() which is a bug.

Mind if I fold it (with credit, obviously)?

No problem, that's fine.

Done.