diff options
| author | David Sin <davidsin@ti.com> | 2011-04-07 08:40:41 +0100 |
|---|---|---|
| committer | Andy Green <andy.green@linaro.org> | 2011-04-07 08:40:41 +0100 |
| commit | e7e9bf6989646999f8cc4e51bb99a5a5b7a3fd72 (patch) | |
| tree | 14401259b3142493e1dd13fbd7cbf738cffa8fb1 /drivers | |
| parent | b45cb314b08e5ff544441521e62e7bbfbe56ef0a (diff) | |
TILER: Free buf info struct if copy_to/copy_from check fails
Signed-off-by: David Sin <davidsin@ti.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/video/tiler/tiler.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/media/video/tiler/tiler.c b/drivers/media/video/tiler/tiler.c index 1f50f31aac0..eaa7c128bd0 100644 --- a/drivers/media/video/tiler/tiler.c +++ b/drivers/media/video/tiler/tiler.c @@ -628,8 +628,9 @@ static s32 tiler_ioctl(struct inode *ip, struct file *filp, u32 cmd, memset(_b, 0x0, sizeof(struct __buf_info)); if (copy_from_user(&_b->buf_info, (void __user *)arg, - sizeof(struct tiler_buf_info))) - return -EFAULT; + sizeof(struct tiler_buf_info))) { + kfree(_b); return -EFAULT; + } _b->buf_info.offset = id; id += 0x1000; @@ -639,8 +640,9 @@ static s32 tiler_ioctl(struct inode *ip, struct file *filp, u32 cmd, mutex_unlock(&mtx); if (copy_to_user((void __user *)arg, &_b->buf_info, - sizeof(struct tiler_buf_info))) - return -EFAULT; + sizeof(struct tiler_buf_info))) { + kfree(_b); return -EFAULT; + } break; case TILIOC_URBUF: if (copy_from_user(&buf_info, (void __user *)arg, |