Commit 2f3242b6 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab Committed by Zicheng Qu
Browse files

media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set 

stable inclusion
from stable-v6.6.63
commit db12e874e1a202206c734d89920e4aa9e290efa2
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KR8
CVE: CVE-2024-53063

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=db12e874e1a202206c734d89920e4aa9e290efa2



--------------------------------

commit a4aebaf6e6efff548b01a3dc49b4b9074751c15b upstream.

When CONFIG_DVB_DYNAMIC_MINORS, ret is not initialized, and a
semaphore is left at the wrong state, in case of errors.

Make the code simpler and avoid mistakes by having just one error
check logic used weather DVB_DYNAMIC_MINORS is used or not.

Reported-by: default avatarkernel test robot <lkp@intel.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202410201717.ULWWdJv8-lkp@intel.com/


Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Link: https://lore.kernel.org/r/9e067488d8935b8cf00959764a1fa5de85d65725.1730926254.git.mchehab+huawei@kernel.org


Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZicheng Qu <quzicheng@huawei.com>
parent 3758f68c

drivers/media/dvb-core/dvbdev.c

+4 −11
Original line number Diff line number Diff line
@@ -544,6 +544,9 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
	for (minor = 0; minor < MAX_DVB_MINORS; minor++)

		if (dvb_minors[minor] == NULL)

			break;

#else

	minor = nums2minor(adap->num, type, id);

#endif

	if (minor >= MAX_DVB_MINORS) {

		if (new_node) {

			list_del (&new_node->list_head);
@@ -557,17 +560,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		mutex_unlock(&dvbdev_register_lock);

		return -EINVAL;

	}

#else

	minor = nums2minor(adap->num, type, id);

	if (minor >= MAX_DVB_MINORS) {

		dvb_media_device_free(dvbdev);

		list_del(&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		mutex_unlock(&dvbdev_register_lock);

		return ret;

	}

#endif



	dvbdev->minor = minor;

	dvb_minors[minor] = dvb_device_get(dvbdev);

	up_write(&minor_rwsem);