summaryrefslogtreecommitdiff
path: root/drivers/input/misc/uinput.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/input/misc/uinput.c')
-rw-r--r--drivers/input/misc/uinput.c23
1 files changed, 12 insertions, 11 deletions
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index c3eebf593ab6..d5c5b32045af 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -251,6 +251,7 @@ static int uinput_alloc_device(struct file *file, const char __user *buffer, siz
struct uinput_user_dev *user_dev;
struct input_dev *dev;
struct uinput_device *udev;
+ char *name;
int size;
int retval;
@@ -274,13 +275,13 @@ static int uinput_alloc_device(struct file *file, const char __user *buffer, siz
kfree(dev->name);
size = strnlen(user_dev->name, UINPUT_MAX_NAME_SIZE) + 1;
- dev->name = kmalloc(size, GFP_KERNEL);
- if (!dev->name) {
+ dev->name = name = kmalloc(size, GFP_KERNEL);
+ if (!name) {
retval = -ENOMEM;
goto exit;
}
+ strlcpy(name, user_dev->name, size);
- strlcpy(dev->name, user_dev->name, size);
dev->id.bustype = user_dev->id.bustype;
dev->id.vendor = user_dev->id.vendor;
dev->id.product = user_dev->id.product;
@@ -397,6 +398,7 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
struct uinput_ff_erase ff_erase;
struct uinput_request *req;
int length;
+ char *phys;
udev = file->private_data;
@@ -494,20 +496,19 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
retval = -EFAULT;
break;
}
- if (NULL != udev->dev->phys)
- kfree(udev->dev->phys);
- udev->dev->phys = kmalloc(length, GFP_KERNEL);
- if (!udev->dev->phys) {
+ kfree(udev->dev->phys);
+ udev->dev->phys = phys = kmalloc(length, GFP_KERNEL);
+ if (!phys) {
retval = -ENOMEM;
break;
}
- if (copy_from_user(udev->dev->phys, p, length)) {
- retval = -EFAULT;
- kfree(udev->dev->phys);
+ if (copy_from_user(phys, p, length)) {
udev->dev->phys = NULL;
+ kfree(phys);
+ retval = -EFAULT;
break;
}
- udev->dev->phys[length - 1] = '\0';
+ phys[length - 1] = '\0';
break;
case UI_BEGIN_FF_UPLOAD: