From: Kevin McKinney <klmckinney1@gmail.com>
Date: Fri, 2 Dec 2011 03:02:15 +0000 (-0500)
Subject: Staging: bcm: Fix double free of 'pReadData' in IOCTL_BCM_NVM_WRITE.
X-Git-Tag: firefly_0821_release~3680^2~3804^2~101^2~32
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=09468b0392b1d2b079b334d60a23d7da8105dc53;p=firefly-linux-kernel-4.4.55.git

Staging: bcm: Fix double free of 'pReadData' in IOCTL_BCM_NVM_WRITE.

This patch fixes a memory error in ioctl,
IOCTL_BCM_NVM_WRITE. While copying data to
user space, if an error occurs, pReadData
is freed. Then, at the end of the ioctl,
pReadData was being freed again.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c
index 72a699c12704..ad1cc5598dca 100644
--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -1336,7 +1336,7 @@ cntrlEnd:
 
 			if (copy_to_user(stNVMReadWrite.pBuffer, pReadData, stNVMReadWrite.uiNumBytes)) {
 				kfree(pReadData);
-				Status = -EFAULT;
+				return -EFAULT;
 			}
 		} else {
 			down(&Adapter->NVMRdmWrmLock);