From: Markus Elfring <redacted>
Date: Sat, 27 Jun 2015 16:00:59 +0200

The kfree() function was called in two cases by the mac_ioctl() function
during error handling even if the passed variable did not contain a pointer
for a valid data item.

* This implementation detail could be improved by the introduction
  of another jump label.

* Drop an unnecessary initialisation for the variable "buff" then.

Signed-off-by: Markus Elfring <redacted>
---
 drivers/staging/wilc1000/linux_wlan.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
index 2aa8d9b..f492310 100644
--- a/drivers/staging/wilc1000/linux_wlan.c
+++ b/drivers/staging/wilc1000/linux_wlan.c

@@ -2351,16 +2351,13 @@ int mac_close(struct net_device *ndev)

 int mac_ioctl(struct net_device *ndev, struct ifreq *req, int cmd)
 {
-
-	u8 *buff = NULL;
+	u8 *buff;
 	s8 rssi;
 	u32 size = 0, length = 0;
 	perInterface_wlan_t *nic;
 	struct WILC_WFI_priv *priv;
 	s32 s32Error = WILC_SUCCESS;

-
-

 	/* struct iwreq *wrq = (struct iwreq *) req;	// tony moved to case SIOCSIWPRIV */
 	#ifdef USE_WIRELESS
 	nic = netdev_priv(ndev);

@@ -2405,7 +2402,7 @@ int mac_ioctl(struct net_device *ndev, struct ifreq *req, int cmd)
 				if (copy_to_user(wrq->u.data.pointer, buff, size)) {
 					PRINT_ER("%s: failed to copy data to user buffer\n", __func__);
 					s32Error = -EFAULT;
-					goto done;
+					goto free_buffer;
 				}
 			}
 		}

@@ -2420,8 +2417,9 @@ int mac_ioctl(struct net_device *ndev, struct ifreq *req, int cmd)
 	}
 	}

-done:
+free_buffer:
 	kfree(buff);
+done:
 	return s32Error;
 }

--

2.4.4

--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html