diff options
| author |   Evgeny Novikov <novikov@ispras.ru> | 2021-07-20 11:28:27 +0200 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2021-09-30 10:07:40 +0200 |
| commit | 36b9d695aa6fb8e9a312db21af41f90824d16ab4 (patch) | |
| tree | 3775d5bbc7d4a6351cec3e8f4fb9592a369b2ce2 /drivers/media/usb/ttusb-dec/ttusb_dec.c | |
| parent | media: cxd2880-spi: Fix a null pointer dereference on error handling path (diff) | |
| download | linux-dev-36b9d695aa6fb8e9a312db21af41f90824d16ab4.tar.xz linux-dev-36b9d695aa6fb8e9a312db21af41f90824d16ab4.zip | |
media: ttusb-dec: avoid release of non-acquired mutex
ttusb_dec_send_command() invokes mutex_lock_interruptible() that can
fail but then it releases the non-acquired mutex. The patch fixes that.
Found by Linux Driver Verification project (linuxtesting.org).
Fixes: dba328bab4c6 ("media: ttusb-dec: cleanup an error handling logic")
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media/usb/ttusb-dec/ttusb_dec.c')
| -rw-r--r-- | drivers/media/usb/ttusb-dec/ttusb_dec.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c index bfda46a36dc5..38822cedd93a 100644 --- a/drivers/media/usb/ttusb-dec/ttusb_dec.c +++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c @@ -327,7 +327,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, result = mutex_lock_interruptible(&dec->usb_mutex); if (result) { printk("%s: Failed to lock usb mutex.\n", __func__); - goto err; + goto err_free; } b[0] = 0xaa; @@ -349,7 +349,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, if (result) { printk("%s: command bulk message failed: error %d\n", __func__, result); - goto err; + goto err_mutex_unlock; } result = usb_bulk_msg(dec->udev, dec->result_pipe, b, @@ -358,7 +358,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, if (result) { printk("%s: result bulk message failed: error %d\n", __func__, result); - goto err; + goto err_mutex_unlock; } else { if (debug) { printk(KERN_DEBUG "%s: result: %*ph\n", @@ -371,9 +371,9 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, memcpy(cmd_result, &b[4], b[3]); } -err: +err_mutex_unlock: mutex_unlock(&dec->usb_mutex); - +err_free: kfree(b); return result; } |