staging: rtl8712: freeing an ERR_PTR

If memdup_user() fails then "pparmbuf" is an error pointer and we can't
pass it to kfree().  I changed the "goto _r871x_mp_ioctl_hdl_exit" to a
direct return.

I changed the earlier goto to a direct return as well for consistency
and removed the "pparmbuf = NULL" initializer since it's no longer
needed.

Fixes: 45de432775d6 ('Staging: rtl8712: Use memdup_user() instead of copy_from_user()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
index 42fba3f5b593e08801a57269ede5e21da8c8841f..cb0b6387789f197dbe2d314b96728d05b6a361c9 100644 (file)
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
@@ -1900,23 +1900,20 @@ static int r871x_mp_ioctl_hdl(struct net_device *dev,
        struct mp_ioctl_handler *phandler;
        struct mp_ioctl_param *poidparam;
        unsigned long BytesRead, BytesWritten, BytesNeeded;
-       u8 *pparmbuf = NULL, bset;
+       u8 *pparmbuf, bset;
        u16 len;
        uint status;
        int ret = 0;
 
-       if ((!p->length) || (!p->pointer)) {
-               ret = -EINVAL;
-               goto _r871x_mp_ioctl_hdl_exit;
-       }
+       if ((!p->length) || (!p->pointer))
+               return -EINVAL;
+
        bset = (u8)(p->flags & 0xFFFF);
        len = p->length;
-       pparmbuf = NULL;
        pparmbuf = memdup_user(p->pointer, len);
-       if (IS_ERR(pparmbuf)) {
-               ret = PTR_ERR(pparmbuf);
-               goto _r871x_mp_ioctl_hdl_exit;
-       }
+       if (IS_ERR(pparmbuf))
+               return PTR_ERR(pparmbuf);
+
        poidparam = (struct mp_ioctl_param *)pparmbuf;
        if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
                ret = -EINVAL;