linux-kernel - Re: [PATCH 2/2] usb: gadget: f_midi: missing unlock on error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 13 Jan 2016 18:29:46 +0000
From:	Felipe Ferreri Tonello <eu@...ipetonello.com>
To:	Michal Nazarewicz <mina86@...a86.com>, Felipe Balbi <balbi@...com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Dan Carpenter <dan.carpenter@...cle.com>
Cc:	Robert Baldyga <r.baldyga@...sung.com>,
	Andrzej Pietrasiewicz <andrzej.p@...sung.com>,
	Pawel Szewczyk <p.szewczyk@...sung.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] usb: gadget: f_midi: missing unlock on error path

Hi Dan,

On 09/01/16 03:47, Michal Nazarewicz wrote:
> From: Dan Carpenter <dan.carpenter@...cle.com>
> 
> We added a new error path to this function and we forgot to drop the
> lock.
> 
> Fixes: e1e3d7ec5da3 ('usb: gadget: f_midi: pre-allocate IN requests')
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> [mina86@...a86.com: rebased on top of refactoring commit]
> Signed-off-by: Michal Nazarewicz <mina86@...a86.com>

Reviewed-by: Felipe F. Tonello <eu@...ipetonello.com>

> ---
>  drivers/usb/gadget/function/f_midi.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
> index fd67af2..f287c68 100644
> --- a/drivers/usb/gadget/function/f_midi.c
> +++ b/drivers/usb/gadget/function/f_midi.c
> @@ -1098,7 +1098,7 @@ static void f_midi_unbind(struct usb_configuration *c, struct usb_function *f)
>  
>  static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  {
> -	struct f_midi *midi;
> +	struct f_midi *midi = NULL;
>  	struct f_midi_opts *opts;
>  	int status, i;
>  
> @@ -1107,8 +1107,8 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  	mutex_lock(&opts->lock);
>  	/* sanity check */
>  	if (opts->in_ports > MAX_PORTS || opts->out_ports > MAX_PORTS) {
> -		mutex_unlock(&opts->lock);
> -		return ERR_PTR(-EINVAL);
> +		status = -EINVAL;
> +		goto setup_fail;
>  	}
>  
>  	/* allocate and initialize one new instance */
> @@ -1116,8 +1116,8 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  		sizeof(*midi) + opts->in_ports * sizeof(*midi->in_ports_array),
>  		GFP_KERNEL);
>  	if (!midi) {
> -		mutex_unlock(&opts->lock);
> -		return ERR_PTR(-ENOMEM);
> +		status = -ENOMEM;
> +		goto setup_fail;
>  	}
>  
>  	for (i = 0; i < opts->in_ports; i++)
> @@ -1127,7 +1127,6 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  	midi->id = kstrdup(opts->id, GFP_KERNEL);
>  	if (opts->id && !midi->id) {
>  		status = -ENOMEM;
> -		mutex_unlock(&opts->lock);
>  		goto setup_fail;
>  	}
>  	midi->in_ports = opts->in_ports;
> @@ -1148,6 +1147,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  	return &midi->func;
>  
>  setup_fail:
> +	mutex_unlock(&opts->lock);
>  	kfree(midi);
>  	return ERR_PTR(status);
>  }
> 

Download attachment "0x92698E6A.asc" of type "application/pgp-keys" (7196 bytes)