From: Dan Carpenter <dan.carpenter@oracle.com>
To: Jens Axboe <axboe@fb.com>, Al Viro <viro@zeniv.linux.org.uk>
Cc: Asai Thambi SP <asamymuthupa@micron.com>,
Selvan Mani <smani@micron.com>, Jeff Moyer <jmoyer@redhat.com>,
Michal Hocko <mhocko@suse.com>,
Rasmus Villemoes <linux@rasmusvillemoes.dk>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [patch] mtip32xx: calling kfree() on an error pointer
Date: Wed, 6 Jan 2016 13:05:03 +0300 [thread overview]
Message-ID: <20160106100503.GH23185@mwanda> (raw)
If memdup_user() fails then we end up passing an ERR_PTR to kfree()
which is a bug.
Fixes: 85b4d87c9962 ('mtip32xx: don't open-code memdup_user()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 618c24f..15bec40 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -2032,6 +2032,7 @@ static int exec_drive_taskfile(struct driver_data *dd,
outbuf = memdup_user(buf + outtotal, taskout);
if (IS_ERR(outbuf)) {
err = PTR_ERR(outbuf);
+ outbuf = NULL;
goto abort;
}
outbuf_dma = pci_map_single(dd->pdev,
@@ -2049,6 +2050,7 @@ static int exec_drive_taskfile(struct driver_data *dd,
inbuf = memdup_user(buf + intotal, taskin);
if (IS_ERR(inbuf)) {
err = PTR_ERR(inbuf);
+ inbuf = NULL;
goto abort;
}
inbuf_dma = pci_map_single(dd->pdev,
next reply other threads:[~2016-01-06 10:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-06 10:05 Dan Carpenter [this message]
2016-01-06 13:08 ` [patch] mtip32xx: calling kfree() on an error pointer Al Viro
2016-01-06 13:16 ` Dan Carpenter
2016-01-06 13:26 ` Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160106100503.GH23185@mwanda \
--to=dan.carpenter@oracle.com \
--cc=asamymuthupa@micron.com \
--cc=axboe@fb.com \
--cc=jmoyer@redhat.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@rasmusvillemoes.dk \
--cc=mhocko@suse.com \
--cc=smani@micron.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).