lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

staging: sep: call to sep_ioctl() may leave driver in unusable state

Browse Source 
If sep_ioctl() is called from a process that does not own
current transaction, it unlocks unheld sep->ioctl_mutex and
returns -EACCES leaving sep->sep_mutex acquired.

The patch fixes the mutex lock-unlock mismatch.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Alexey Khoroshilov
2011-08-31 01:57:10 +04:00
committed by Greg Kroah-Hartman
parent 129957069e
commit f19885fadf
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/staging/sep/sep_driver.c
View File

@@ -2420,11 +2420,12 @@ static long sep_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
(sep->pid_doing_transaction != 0)) { (sep->pid_doing_transaction != 0)) {
dev_dbg(&sep->pdev->dev, "ioctl pid is not owner\n"); dev_dbg(&sep->pdev->dev, "ioctl pid is not owner\n");
error = -EACCES; error = -EACCES;
goto end_function;
} }
mutex_unlock(&sep->sep_mutex); mutex_unlock(&sep->sep_mutex);
if (error)
return error;
if (_IOC_TYPE(cmd) != SEP_IOC_MAGIC_NUMBER) if (_IOC_TYPE(cmd) != SEP_IOC_MAGIC_NUMBER)
return -ENOTTY; return -ENOTTY;
@@ -2461,7 +2462,6 @@ static long sep_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
break; break;
} }
end_function:
mutex_unlock(&sep->ioctl_mutex); mutex_unlock(&sep->ioctl_mutex);
return error; return error;
} }