linux-kernel - Staging: Media: Lirc - Fix possible ERR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <1474354281-18962-1-git-send-email-shailendra.v@samsung.com>
Date:   Tue, 20 Sep 2016 12:21:21 +0530
From:   Shailendra Verma <shailendra.v@...sung.com>
To:     Jarod Wilson <jarod@...sonet.com>,
        Mauro Carvalho Chehab <mchehab@....samsung.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-media@...r.kernel.org, devel@...verdev.osuosl.org,
        Shailendra Verma <shailendra.v@...sung.com>,
        Ravikant Sharma <ravikant.s2@...sung.com>
Cc:     linux-kernel@...r.kernel.org, vidushi.koul@...sung.com
Subject: Staging: Media: Lirc - Fix possible ERR_PTR() dereferencing.

This is of course wrong to call kfree() if memdup_user() fails,
no memory was allocated and the error in the error-valued pointer
should be returned.

Reviewed-by: Ravikant Sharma <ravikant.s2@...sung.com>
Signed-off-by: Shailendra Verma <shailendra.v@...sung.com>
---
 drivers/staging/media/lirc/lirc_imon.c  | 7 ++-----
 drivers/staging/media/lirc/lirc_sasem.c | 7 ++-----
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/media/lirc/lirc_imon.c b/drivers/staging/media/lirc/lirc_imon.c
index 534b810..c21591b 100644
--- a/drivers/staging/media/lirc/lirc_imon.c
+++ b/drivers/staging/media/lirc/lirc_imon.c
@@ -409,11 +409,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf,
 	}
 
 	data_buf = memdup_user(buf, n_bytes);
-	if (IS_ERR(data_buf)) {
-		retval = PTR_ERR(data_buf);
-		data_buf = NULL;
-		goto exit;
-	}
+	if (IS_ERR(data_buf))
+		return PTR_ERR(data_buf);
 
 	memcpy(context->tx.data_buf, data_buf, n_bytes);
 
diff --git a/drivers/staging/media/lirc/lirc_sasem.c b/drivers/staging/media/lirc/lirc_sasem.c
index f2dca69..ba1ee86 100644
--- a/drivers/staging/media/lirc/lirc_sasem.c
+++ b/drivers/staging/media/lirc/lirc_sasem.c
@@ -387,11 +387,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf,
 	}
 
 	data_buf = memdup_user(buf, n_bytes);
-	if (IS_ERR(data_buf)) {
-		retval = PTR_ERR(data_buf);
-		data_buf = NULL;
-		goto exit;
-	}
+	if (IS_ERR(data_buf))
+		return PTR_ERR(data_buf);
 
 	memcpy(context->tx.data_buf, data_buf, n_bytes);
 
-- 
1.9.1