In hgcm_call_preprocess_linaddr memory is allocated for bounce_buf but
is not released if copy_form_user fails. The release is added.

Fixes: 579db9d45cb4 ("virt: Add vboxguest VMMDEV communication code")

Signed-off-by: Navid Emamdoost <[email protected]>
---
 drivers/virt/vboxguest/vboxguest_utils.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/virt/vboxguest/vboxguest_utils.c 
b/drivers/virt/vboxguest/vboxguest_utils.c
index 75fd140b02ff..7965885a50fa 100644
--- a/drivers/virt/vboxguest/vboxguest_utils.c
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -222,8 +222,10 @@ static int hgcm_call_preprocess_linaddr(
 
        if (copy_in) {
                ret = copy_from_user(bounce_buf, (void __user *)buf, len);
-               if (ret)
+               if (ret) {
+                       kvfree(bounce_buf);
                        return -EFAULT;
+               }
        } else {
                memset(bounce_buf, 0, len);
        }
-- 
2.17.1

Reply via email to