usb: gadget: gadgetfs: fix an oops in ep_write()

Dan Carpenter · Felipe Balbi · commit 42d6cfa0caec · 2015-01-09T18:15:11.000-06:00
We try to free an ERR_PTR on this error path. Fixes: b44be24 ('usb: gadget: gadgetfs: Free memory allocated by memdup_user()') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
@@ -441,6 +441,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 	kbuf = memdup_user(buf, len);
 	if (IS_ERR(kbuf)) {
 		value = PTR_ERR(kbuf);
+		kbuf = NULL;
 		goto free1;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -441,6 +441,7 @@ ep_write (struct file fd, const char __user buf, size_t len, loff_t *ptr)`
`441`	`441`	`kbuf = memdup_user(buf, len);`
`442`	`442`	`if (IS_ERR(kbuf)) {`
`443`	`443`	`value = PTR_ERR(kbuf);`
	`444`	`+ kbuf = NULL;`
`444`	`445`	`goto free1;`
`445`	`446`	`}`
`446`	`447`