lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 381/849] media: ttusb-dec: avoid release of non-acquired mutex
    Date
    From: Evgeny Novikov <novikov@ispras.ru>

    [ Upstream commit 36b9d695aa6fb8e9a312db21af41f90824d16ab4 ]

    ttusb_dec_send_command() invokes mutex_lock_interruptible() that can
    fail but then it releases the non-acquired mutex. The patch fixes that.

    Found by Linux Driver Verification project (linuxtesting.org).

    Fixes: dba328bab4c6 ("media: ttusb-dec: cleanup an error handling logic")
    Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
    Signed-off-by: Sean Young <sean@mess.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/ttusb-dec/ttusb_dec.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
    index bfda46a36dc50..38822cedd93a9 100644
    --- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
    +++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
    @@ -327,7 +327,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
    result = mutex_lock_interruptible(&dec->usb_mutex);
    if (result) {
    printk("%s: Failed to lock usb mutex.\n", __func__);
    - goto err;
    + goto err_free;
    }

    b[0] = 0xaa;
    @@ -349,7 +349,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
    if (result) {
    printk("%s: command bulk message failed: error %d\n",
    __func__, result);
    - goto err;
    + goto err_mutex_unlock;
    }

    result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
    @@ -358,7 +358,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
    if (result) {
    printk("%s: result bulk message failed: error %d\n",
    __func__, result);
    - goto err;
    + goto err_mutex_unlock;
    } else {
    if (debug) {
    printk(KERN_DEBUG "%s: result: %*ph\n",
    @@ -371,9 +371,9 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
    memcpy(cmd_result, &b[4], b[3]);
    }

    -err:
    +err_mutex_unlock:
    mutex_unlock(&dec->usb_mutex);
    -
    +err_free:
    kfree(b);
    return result;
    }
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-15 23:56    [W:4.028 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site