diff mbox

[v3] staging: wilc1000: fix double mutex_unlock on failure path in wilc_wlan_cleanup()

Message ID 1450805966-9193-1-git-send-email-khoroshilov@ispras.ru (mailing list archive)
State Not Applicable
Delegated to: Kalle Valo
Headers show

Commit Message

Alexey Khoroshilov Dec. 22, 2015, 5:39 p.m. UTC
If hif_read_reg() or hif_write_reg() fail in wilc_wlan_cleanup(),
it calls release_bus() and continues execution. But it leads to double
release_bus() call that means double unlock of g_linux_wlan->hif_cs mutex.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
 drivers/staging/wilc1000/wilc_wlan.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Greg Kroah-Hartman Feb. 3, 2016, 11:04 p.m. UTC | #1
On Tue, Dec 22, 2015 at 08:39:26PM +0300, Alexey Khoroshilov wrote:
> If hif_read_reg() or hif_write_reg() fail in wilc_wlan_cleanup(),
> it calls release_bus() and continues execution. But it leads to double
> release_bus() call that means double unlock of g_linux_wlan->hif_cs mutex.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
> ---
>  drivers/staging/wilc1000/wilc_wlan.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)

Why is this 'v3'?  What changed from the other versions?  Please always
document it below the --- line so that we have a chance when reviewing
them.

Please fix up and resend with that information.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 83af51b..b8c4a63 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1381,15 +1381,16 @@  void wilc_wlan_cleanup(struct net_device *dev)
 	ret = wilc->hif_func->hif_read_reg(wilc, WILC_GP_REG_0, &reg);
 	if (!ret) {
 		PRINT_ER("Error while reading reg\n");
-		release_bus(wilc, RELEASE_ALLOW_SLEEP);
+		goto unlock;
 	}
 	PRINT_ER("Writing ABORT reg\n");
 	ret = wilc->hif_func->hif_write_reg(wilc, WILC_GP_REG_0,
 					(reg | ABORT_INT));
 	if (!ret) {
 		PRINT_ER("Error while writing reg\n");
-		release_bus(wilc, RELEASE_ALLOW_SLEEP);
+		goto unlock;
 	}
+unlock:
 	release_bus(wilc, RELEASE_ALLOW_SLEEP);
 	wilc->hif_func->hif_deinit(NULL);
 }