sx.c: avoid referencing freed memory if copy_from_user() fails

[uclinux-h8/linux.git] / drivers / char / sx.c

diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index d7c4165..518f2a2 100644 (file)
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1789,7 +1789,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                                                nbytes - i : SX_CHUNK_SIZE)) {
                                        kfree(tmp);
                                        rc = -EFAULT;
-                                       break;
+                                       goto out;
                                }
                                memcpy_toio(board->base2 + offset + i, tmp,
                                                (i + SX_CHUNK_SIZE > nbytes) ?