Commit 8fe72b76 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jassi Brar
Browse files

mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() 



There was a bug where this code forgot to unlock the tdev->mutex if the
kzalloc() failed.  Fix this issue, by moving the allocation outside the
lock.

Fixes: 2d1e952a ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarLee Jones <lee@kernel.org>
Signed-off-by: default avatarJassi Brar <jaswinder.singh@linaro.org>
parent 884fe9da

drivers/mailbox/mailbox-test.c

+6 −4
Original line number Diff line number Diff line
@@ -98,6 +98,7 @@ static ssize_t mbox_test_message_write(struct file *filp, 
				       size_t count, loff_t *ppos)

{

	struct mbox_test_device *tdev = filp->private_data;

	char *message;

	void *data;

	int ret;
@@ -113,12 +114,13 @@ static ssize_t mbox_test_message_write(struct file *filp, 
		return -EINVAL;

	}



	mutex_lock(&tdev->mutex);



	tdev->message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);

	if (!tdev->message)

	message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);

	if (!message)

		return -ENOMEM;



	mutex_lock(&tdev->mutex);



	tdev->message = message;

	ret = copy_from_user(tdev->message, userbuf, count);

	if (ret) {

		ret = -EFAULT;