| Message ID | 1452755489-18736-2-git-send-email-lee.jones@linaro.org |
|---|---|
| State | New |
| Headers | show |
On Thu, Jan 14, 2016 at 12:41 PM, Lee Jones <lee.jones@linaro.org> wrote: > While we're at it, ensure copy-to location is NULL'ed in the error path. > > Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Lee Jones <lee.jones@linaro.org> > --- > drivers/mailbox/mailbox-test.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c > index 684ae17..7d9b915 100644 > --- a/drivers/mailbox/mailbox-test.c > +++ b/drivers/mailbox/mailbox-test.c > @@ -63,9 +63,9 @@ static ssize_t mbox_test_signal_write(struct file *filp, > if (!tdev->signal) > return -ENOMEM; > > - ret = copy_from_user(tdev->signal, userbuf, count); > - if (ret) { > + if (copy_from_user(tdev->signal, userbuf, count)) { > kfree(tdev->signal); > + tdev->signal = NULL; > return -EFAULT; > } > The function is left to return based on an uninitialized variable ('ret' on stack), so please merge this and the patch 2/4. Thanks.
diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index 684ae17..7d9b915 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -63,9 +63,9 @@ static ssize_t mbox_test_signal_write(struct file *filp, if (!tdev->signal) return -ENOMEM; - ret = copy_from_user(tdev->signal, userbuf, count); - if (ret) { + if (copy_from_user(tdev->signal, userbuf, count)) { kfree(tdev->signal); + tdev->signal = NULL; return -EFAULT; }
While we're at it, ensure copy-to location is NULL'ed in the error path. Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> --- drivers/mailbox/mailbox-test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 1.9.1