Commit 2754208a authored by Hans Verkuil's avatar Hans Verkuil Committed by Ye Bin
Browse files

media: dvb-usb-v2: af9035: fix missing unlock 

stable inclusion
from stable-v5.10.201
commit 1b86938925bdd618aea295f64874978d3b209e5f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAPHC5
CVE: CVE-2023-52915

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b86938925bdd618aea295f64874978d3b209e5f



--------------------------------

[ Upstream commit f31b2cb85f0ee165d78e1c43f6d69f82cc3b2145 ]

Instead of returning an error, goto the mutex unlock at
the end of the function.

Fixes smatch warning:

drivers/media/usb/dvb-usb-v2/af9035.c:467 af9035_i2c_master_xfer() warn: inconsistent returns '&d->i2c_mutex'.
  Locked on  : 326,387
  Unlocked on: 465,467

Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 7bf744f2 ("media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer")
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
parent 273a923b

drivers/media/usb/dvb-usb-v2/af9035.c

+9 −4
Original line number Diff line number Diff line
@@ -322,8 +322,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			ret = -EOPNOTSUPP;

		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||

			   (msg[0].addr == state->af9033_i2c_addr[1])) {

			if (msg[0].len < 3 || msg[1].len < 1)

				return -EOPNOTSUPP;

			if (msg[0].len < 3 || msg[1].len < 1) {

				ret = -EOPNOTSUPP;

				goto unlock;

			}

			/* demod access via firmware interface */

			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

					msg[0].buf[2];
@@ -383,8 +385,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			ret = -EOPNOTSUPP;

		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||

			   (msg[0].addr == state->af9033_i2c_addr[1])) {

			if (msg[0].len < 3)

				return -EOPNOTSUPP;

			if (msg[0].len < 3) {

				ret = -EOPNOTSUPP;

				goto unlock;

			}

			/* demod access via firmware interface */

			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

					msg[0].buf[2];
@@ -459,6 +463,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
		ret = -EOPNOTSUPP;

	}



unlock:

	mutex_unlock(&d->i2c_mutex);



	if (ret < 0)