From: Markus Elfring <elfr...@users.sourceforge.net>
Date: Thu, 13 Oct 2016 10:50:24 +0200

The kfree() function was called in one case by the
redrat3_transmit_ir() function during error handling
even if the passed variable contained a null pointer.

* Adjust jump targets according to the Linux coding style convention.

* Move the resetting for the data structure member "transmitting"
  at the end.

* Delete initialisations for the variables "irdata" and "sample_lens"
  at the beginning which became unnecessary with this refactoring.

Signed-off-by: Markus Elfring <elfr...@users.sourceforge.net>
---
 drivers/media/rc/redrat3.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 7ae2ced..71e901d 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -723,10 +723,10 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, 
unsigned *txbuf,
 {
        struct redrat3_dev *rr3 = rcdev->priv;
        struct device *dev = rr3->dev;
-       struct redrat3_irdata *irdata = NULL;
+       struct redrat3_irdata *irdata;
        int ret, ret_len;
        int lencheck, cur_sample_len, pipe;
-       int *sample_lens = NULL;
+       int *sample_lens;
        u8 curlencheck;
        unsigned i, sendbuf_len;
 
@@ -747,7 +747,7 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, 
unsigned *txbuf,
        irdata = kzalloc(sizeof(*irdata), GFP_KERNEL);
        if (!irdata) {
                ret = -ENOMEM;
-               goto out;
+               goto free_sample;
        }
 
        /* rr3 will disable rc detector on transmit */
@@ -776,7 +776,7 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, 
unsigned *txbuf,
                                curlencheck++;
                        } else {
                                ret = -EINVAL;
-                               goto out;
+                               goto reset_member;
                        }
                }
                irdata->sigdata[i] = lencheck;
@@ -811,14 +811,12 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, 
unsigned *txbuf,
                dev_err(dev, "Error: control msg send failed, rc %d\n", ret);
        else
                ret = count;
-
-out:
-       kfree(irdata);
-       kfree(sample_lens);
-
+reset_member:
        rr3->transmitting = false;
        /* rr3 re-enables rc detector because it was enabled before */
-
+       kfree(irdata);
+free_sample:
+       kfree(sample_lens);
        return ret;
 }
 
-- 
2.10.1

Reply via email to