Commit 36b9d695 authored by Evgeny Novikov's avatar Evgeny Novikov Committed by Mauro Carvalho Chehab
Browse files

media: ttusb-dec: avoid release of non-acquired mutex 



ttusb_dec_send_command() invokes mutex_lock_interruptible() that can
fail but then it releases the non-acquired mutex. The patch fixes that.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: dba328ba ("media: ttusb-dec: cleanup an error handling logic")
Signed-off-by: default avatarEvgeny Novikov <novikov@ispras.ru>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 11b982e9

drivers/media/usb/ttusb-dec/ttusb_dec.c

+5 −5
Original line number Diff line number Diff line
@@ -327,7 +327,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, 
	result = mutex_lock_interruptible(&dec->usb_mutex);

	if (result) {

		printk("%s: Failed to lock usb mutex.\n", __func__);

		goto err;

		goto err_free;

	}



	b[0] = 0xaa;
@@ -349,7 +349,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, 
	if (result) {

		printk("%s: command bulk message failed: error %d\n",

		       __func__, result);

		goto err;

		goto err_mutex_unlock;

	}



	result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
@@ -358,7 +358,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, 
	if (result) {

		printk("%s: result bulk message failed: error %d\n",

		       __func__, result);

		goto err;

		goto err_mutex_unlock;

	} else {

		if (debug) {

			printk(KERN_DEBUG "%s: result: %*ph\n",
@@ -371,9 +371,9 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, 
			memcpy(cmd_result, &b[4], b[3]);

	}



err:

err_mutex_unlock:

	mutex_unlock(&dec->usb_mutex);



err_free:

	kfree(b);

	return result;

}