aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2017-12-19 16:48:25 +0000
committerSean Young <sean@mess.org>2018-01-05 15:13:14 +0000
commitf3770143270ec8ce8c574c3f6de1da031cc145db (patch)
tree339fdd85a3e3130d4eb7c20135a43d32c0fe6963
parent6f0e5fd39143a59c22d60e7befc4f33f22aeed2f (diff)
media: lirc: don't kfree the uninitialized pointer txbuf
The current error exit path if ir_raw_encode_scancode fails is via the label out_kfree which kfree's an uninitialized pointer txbuf. Fix this by exiting via a new exit path that does not kfree txbuf. Also exit via this new exit path for a failed allocation of txbuf to avoid a redundant kfree on a NULL pointer (to save a bunch of CPU cycles). Detected by: CoverityScan, CID#1463070 ("Uninitialized pointer read") Fixes: f81a8158d4fb ("media: lirc: release lock before sleep") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Sean Young <sean@mess.org>
-rw-r--r--drivers/media/rc/lirc_dev.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 713d42e4b661..c04c546bf092 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -295,14 +295,14 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf,
ret = ir_raw_encode_scancode(scan.rc_proto, scan.scancode,
raw, LIRCBUF_SIZE);
if (ret < 0)
- goto out_kfree;
+ goto out_kfree_raw;
count = ret;
txbuf = kmalloc_array(count, sizeof(unsigned int), GFP_KERNEL);
if (!txbuf) {
ret = -ENOMEM;
- goto out_kfree;
+ goto out_kfree_raw;
}
for (i = 0; i < count; i++)
@@ -366,6 +366,7 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf,
return n;
out_kfree:
kfree(txbuf);
+out_kfree_raw:
kfree(raw);
out_unlock:
mutex_unlock(&dev->lock);

Privacy Policy