On Thu, Jan 14, 2016 at 12:41 PM, Lee Jones <[email protected]> wrote: > While we're at it, ensure copy-to location is NULL'ed in the error path. > > Suggested-by: Dan Carpenter <[email protected]> > Signed-off-by: Lee Jones <[email protected]> > --- > drivers/mailbox/mailbox-test.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c > index 684ae17..7d9b915 100644 > --- a/drivers/mailbox/mailbox-test.c > +++ b/drivers/mailbox/mailbox-test.c > @@ -63,9 +63,9 @@ static ssize_t mbox_test_signal_write(struct file *filp, > if (!tdev->signal) > return -ENOMEM; > > - ret = copy_from_user(tdev->signal, userbuf, count); > - if (ret) { > + if (copy_from_user(tdev->signal, userbuf, count)) { > kfree(tdev->signal); > + tdev->signal = NULL; > return -EFAULT; > } > The function is left to return based on an uninitialized variable ('ret' on stack), so please merge this and the patch 2/4.
Thanks.
