From 6b16bb90fd8670e316a1cf8e8ef1d94a3f601aff Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Sun, 28 Jun 2009 23:34:14 +0200 Subject: [PATCH] --- yaml --- r: 155383 b: refs/heads/master c: d794a02111cd3393da69bc7d6dd2b6074bd037cc h: refs/heads/master i: 155381: 2dce3efc120d26aa0769ccf58c2c4a3c06cee196 155379: ef8de340797ece0200f2254b8c4178df9c92b815 155375: 155ef7af1d300928099f5ad24ae4fe5cbe01d2a8 v: v3 --- [refs] | 2 +- trunk/drivers/usb/core/devio.c | 16 ++++++++++------ 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/[refs] b/[refs] index 284d062d7bf5..45fba95c0000 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: ba516de332c0e574457e58fb5aa0293e628b7b10 +refs/heads/master: d794a02111cd3393da69bc7d6dd2b6074bd037cc diff --git a/trunk/drivers/usb/core/devio.c b/trunk/drivers/usb/core/devio.c index 308609039c73..706f18156af8 100644 --- a/trunk/drivers/usb/core/devio.c +++ b/trunk/drivers/usb/core/devio.c @@ -1231,22 +1231,22 @@ static int processcompl(struct async *as, void __user * __user *arg) if (as->userbuffer) if (copy_to_user(as->userbuffer, urb->transfer_buffer, urb->transfer_buffer_length)) - return -EFAULT; + goto err_out; if (put_user(as->status, &userurb->status)) - return -EFAULT; + goto err_out; if (put_user(urb->actual_length, &userurb->actual_length)) - return -EFAULT; + goto err_out; if (put_user(urb->error_count, &userurb->error_count)) - return -EFAULT; + goto err_out; if (usb_endpoint_xfer_isoc(&urb->ep->desc)) { for (i = 0; i < urb->number_of_packets; i++) { if (put_user(urb->iso_frame_desc[i].actual_length, &userurb->iso_frame_desc[i].actual_length)) - return -EFAULT; + goto err_out; if (put_user(urb->iso_frame_desc[i].status, &userurb->iso_frame_desc[i].status)) - return -EFAULT; + goto err_out; } } @@ -1255,6 +1255,10 @@ static int processcompl(struct async *as, void __user * __user *arg) if (put_user(addr, (void __user * __user *)arg)) return -EFAULT; return 0; + +err_out: + free_async(as); + return -EFAULT; } static struct async *reap_as(struct dev_state *ps)