Skip to content

Commit

Permalink
HID: unlock properly on error paths in hidraw_ioctl()
Browse files Browse the repository at this point in the history
We can't return immediately because lock_kernel() is held.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
  • Loading branch information
Dan Carpenter authored and Jiri Kosina committed Feb 17, 2009
1 parent 35cfd1d commit dfd395a
Showing 1 changed file with 9 additions and 5 deletions.
14 changes: 9 additions & 5 deletions drivers/hid/hidraw.c
Original file line number Diff line number Diff line change
Expand Up @@ -267,8 +267,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
default:
{
struct hid_device *hid = dev->hid;
if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ)
return -EINVAL;
if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ) {
ret = -EINVAL;
break;
}

if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
int len;
Expand All @@ -277,8 +279,9 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
len = strlen(hid->name) + 1;
if (len > _IOC_SIZE(cmd))
len = _IOC_SIZE(cmd);
return copy_to_user(user_arg, hid->name, len) ?
ret = copy_to_user(user_arg, hid->name, len) ?
-EFAULT : len;
break;
}

if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
Expand All @@ -288,12 +291,13 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
len = strlen(hid->phys) + 1;
if (len > _IOC_SIZE(cmd))
len = _IOC_SIZE(cmd);
return copy_to_user(user_arg, hid->phys, len) ?
ret = copy_to_user(user_arg, hid->phys, len) ?
-EFAULT : len;
break;
}
}

ret = -ENOTTY;
ret = -ENOTTY;
}
unlock_kernel();
return ret;
Expand Down

0 comments on commit dfd395a

Please sign in to comment.