Commit f19885fa authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Greg Kroah-Hartman
Browse files

staging: sep: call to sep_ioctl() may leave driver in unusable state 



If sep_ioctl() is called from a process that does not own
current transaction, it unlocks unheld sep->ioctl_mutex and
returns -EACCES leaving sep->sep_mutex acquired.

The patch fixes the mutex lock-unlock mismatch.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 12995706

drivers/staging/sep/sep_driver.c

+3 −3
Original line number Diff line number Diff line
@@ -2420,11 +2420,12 @@ static long sep_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
				(sep->pid_doing_transaction != 0)) {

		dev_dbg(&sep->pdev->dev, "ioctl pid is not owner\n");

		error = -EACCES;

		goto end_function;

	}



	mutex_unlock(&sep->sep_mutex);



	if (error)

		return error;



	if (_IOC_TYPE(cmd) != SEP_IOC_MAGIC_NUMBER)

		return -ENOTTY;
@@ -2461,7 +2462,6 @@ static long sep_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		break;

	}



end_function:

	mutex_unlock(&sep->ioctl_mutex);

	return error;

}