Re: Staging: Media: Lirc - Fix possible ERR_PTR() dereferencing.

[Dan Carpenter]

On Tue, Sep 20, 2016 at 12:21:21PM +0530, Shailendra Verma wrote:
> This is of course wrong to call kfree() if memdup_user() fails,
> no memory was allocated and the error in the error-valued pointer
> should be returned.
> 
> Reviewed-by: Ravikant Sharma 
> Signed-off-by: Shailendra Verma 

Calling kfree(NULL) is fine so there is no bug in the original code.
Also this patch creates a new locking bug.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Staging: Media: Lirc - Fix possible ERR_PTR() dereferencing.

[Shailendra Verma]

This is of course wrong to call kfree() if memdup_user() fails,
no memory was allocated and the error in the error-valued pointer
should be returned.

Reviewed-by: Ravikant Sharma 
Signed-off-by: Shailendra Verma 
---
 drivers/staging/media/lirc/lirc_imon.c  | 7 ++-
 drivers/staging/media/lirc/lirc_sasem.c | 7 ++-
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/media/lirc/lirc_imon.c 
b/drivers/staging/media/lirc/lirc_imon.c
index 534b810..c21591b 100644
--- a/drivers/staging/media/lirc/lirc_imon.c
+++ b/drivers/staging/media/lirc/lirc_imon.c
@@ -409,11 +409,8 @@ static ssize_t vfd_write(struct file *file, const char 
__user *buf,
}
 
data_buf = memdup_user(buf, n_bytes);
-   if (IS_ERR(data_buf)) {
-   retval = PTR_ERR(data_buf);
-   data_buf = NULL;
-   goto exit;
-   }
+   if (IS_ERR(data_buf))
+   return PTR_ERR(data_buf);
 
memcpy(context->tx.data_buf, data_buf, n_bytes);
 
diff --git a/drivers/staging/media/lirc/lirc_sasem.c 
b/drivers/staging/media/lirc/lirc_sasem.c
index f2dca69..ba1ee86 100644
--- a/drivers/staging/media/lirc/lirc_sasem.c
+++ b/drivers/staging/media/lirc/lirc_sasem.c
@@ -387,11 +387,8 @@ static ssize_t vfd_write(struct file *file, const char 
__user *buf,
}
 
data_buf = memdup_user(buf, n_bytes);
-   if (IS_ERR(data_buf)) {
-   retval = PTR_ERR(data_buf);
-   data_buf = NULL;
-   goto exit;
-   }
+   if (IS_ERR(data_buf))
+   return PTR_ERR(data_buf);
 
memcpy(context->tx.data_buf, data_buf, n_bytes);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html