From: Navid Emamdoost navid.emamdoost@gmail.com
commit bbe692e349e2a1edf3fe0a29a0e05899c9c94d51 upstream.
In rpmsg_eptdev_write_iter, if copy_from_iter_full fails the allocated buffer needs to be released.
Signed-off-by: Navid Emamdoost navid.emamdoost@gmail.com Signed-off-by: Bjorn Andersson bjorn.andersson@linaro.org Cc: Ben Hutchings ben.hutchings@codethink.co.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/rpmsg/rpmsg_char.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/rpmsg/rpmsg_char.c +++ b/drivers/rpmsg/rpmsg_char.c @@ -227,8 +227,10 @@ static ssize_t rpmsg_eptdev_write_iter(s if (!kbuf) return -ENOMEM;
- if (!copy_from_iter_full(kbuf, len, from)) - return -EFAULT; + if (!copy_from_iter_full(kbuf, len, from)) { + ret = -EFAULT; + goto free_kbuf; + }
if (mutex_lock_interruptible(&eptdev->ept_lock)) { ret = -ERESTARTSYS;