aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlexey Khoroshilov <khoroshilov@ispras.ru>2011-08-31 01:57:10 +0400
committerGreg Kroah-Hartman <gregkh@suse.de>2011-09-06 16:49:29 -0700
commitf19885fadfdb0bf410b5e31c7dc2f2be7815e454 (patch)
tree530f344ae8d8f8a784faa32697f34473f406fdb8
parent129957069e6af42a6e021d90679c56662c95f7e1 (diff)
staging: sep: call to sep_ioctl() may leave driver in unusable state
If sep_ioctl() is called from a process that does not own current transaction, it unlocks unheld sep->ioctl_mutex and returns -EACCES leaving sep->sep_mutex acquired. The patch fixes the mutex lock-unlock mismatch. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/staging/sep/sep_driver.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/staging/sep/sep_driver.c b/drivers/staging/sep/sep_driver.c
index bf7286e..8ac3fae 100644
--- a/drivers/staging/sep/sep_driver.c
+++ b/drivers/staging/sep/sep_driver.c
@@ -2420,11 +2420,12 @@ static long sep_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
(sep->pid_doing_transaction != 0)) {
dev_dbg(&sep->pdev->dev, "ioctl pid is not owner\n");
error = -EACCES;
- goto end_function;
}
-
mutex_unlock(&sep->sep_mutex);
+ if (error)
+ return error;
+
if (_IOC_TYPE(cmd) != SEP_IOC_MAGIC_NUMBER)
return -ENOTTY;
@@ -2461,7 +2462,6 @@ static long sep_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
break;
}
-end_function:
mutex_unlock(&sep->ioctl_mutex);
return error;
}