Commit 36b9d695 authored by Evgeny Novikov's avatar Evgeny Novikov Committed by Mauro Carvalho Chehab

media: ttusb-dec: avoid release of non-acquired mutex

ttusb_dec_send_command() invokes mutex_lock_interruptible() that can
fail but then it releases the non-acquired mutex. The patch fixes that.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: dba328ba ("media: ttusb-dec: cleanup an error handling logic")
Signed-off-by: default avatarEvgeny Novikov <novikov@ispras.ru>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 11b982e9
...@@ -327,7 +327,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, ...@@ -327,7 +327,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
result = mutex_lock_interruptible(&dec->usb_mutex); result = mutex_lock_interruptible(&dec->usb_mutex);
if (result) { if (result) {
printk("%s: Failed to lock usb mutex.\n", __func__); printk("%s: Failed to lock usb mutex.\n", __func__);
goto err; goto err_free;
} }
b[0] = 0xaa; b[0] = 0xaa;
...@@ -349,7 +349,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, ...@@ -349,7 +349,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
if (result) { if (result) {
printk("%s: command bulk message failed: error %d\n", printk("%s: command bulk message failed: error %d\n",
__func__, result); __func__, result);
goto err; goto err_mutex_unlock;
} }
result = usb_bulk_msg(dec->udev, dec->result_pipe, b, result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
...@@ -358,7 +358,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, ...@@ -358,7 +358,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
if (result) { if (result) {
printk("%s: result bulk message failed: error %d\n", printk("%s: result bulk message failed: error %d\n",
__func__, result); __func__, result);
goto err; goto err_mutex_unlock;
} else { } else {
if (debug) { if (debug) {
printk(KERN_DEBUG "%s: result: %*ph\n", printk(KERN_DEBUG "%s: result: %*ph\n",
...@@ -371,9 +371,9 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, ...@@ -371,9 +371,9 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
memcpy(cmd_result, &b[4], b[3]); memcpy(cmd_result, &b[4], b[3]);
} }
err: err_mutex_unlock:
mutex_unlock(&dec->usb_mutex); mutex_unlock(&dec->usb_mutex);
err_free:
kfree(b); kfree(b);
return result; return result;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment