[patch] mtip32xx: double free if copy_from_user() fails
From: Dan Carpenter <hidden>
Date: 2011-09-21 07:13:08
Also in:
lkml
Subsystem:
block layer, the rest · Maintainers:
Jens Axboe, Linus Torvalds
We call kfree(req_task) after we go to abort so it isn't needed here. Signed-off-by: Dan Carpenter <redacted>
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 847b8ff..0d23d8c 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c@@ -1674,7 +1674,6 @@ static int exec_drive_taskfile(struct driver_data *dd, intotal = compat_tasksize + req_task->out_size; } else { if (copy_from_user(req_task, buf, tasksize)) { - kfree(req_task); err = -EFAULT; goto abort; }