lkml.org 
[lkml]   [2011]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[patch] mtip32xx: double free if copy_from_user() fails
We call kfree(req_task) after we go to abort so it isn't needed here.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 847b8ff..0d23d8c 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -1674,7 +1674,6 @@ static int exec_drive_taskfile(struct driver_data *dd,
intotal = compat_tasksize + req_task->out_size;
} else {
if (copy_from_user(req_task, buf, tasksize)) {
- kfree(req_task);
err = -EFAULT;
goto abort;
}

\
 
 \ /
  Last update: 2011-09-21 09:15    [W:0.026 / U:1.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site