You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
100 lines
2.9 KiB
100 lines
2.9 KiB
From 887e6314eff34eb9a2e518bb96b65b82cd2f5e68 Mon Sep 17 00:00:00 2001
|
|
From: Jarod Wilson <jarod@redhat.com>
|
|
Date: Tue, 7 Feb 2012 10:48:50 -0500
|
|
Subject: [PATCH 15/17] [media] lirc_dev: fixes in lirc_dev_fop_read()
|
|
|
|
Backport from upstream kernel:
|
|
|
|
commit 250f7a5f62a08985af5cf7728ae7ba9edbfdc0a9
|
|
Author: Dan Carpenter <error27@gmail.com>
|
|
Date: Wed Nov 17 02:20:15 2010 -0300
|
|
|
|
[media] lirc_dev: fixes in lirc_dev_fop_read()
|
|
|
|
This makes several changes but they're in one function and sort of
|
|
related:
|
|
|
|
"buf" was leaked on error. The leak if we try to read an invalid
|
|
length is the main concern because it could be triggered over and
|
|
over.
|
|
|
|
If the copy_to_user() failed, then the original code returned the
|
|
number of bytes remaining. read() is supposed to be the opposite way,
|
|
where we return the number of bytes copied. I changed it to just return
|
|
-EFAULT on errors.
|
|
|
|
Also I changed the debug output from "-EFAULT" to just "<fail>" because
|
|
it isn't -EFAULT necessarily. And since we go though that path if the
|
|
length is invalid now, there was another debug print that I removed.
|
|
|
|
Signed-off-by: Dan Carpenter <error27@gmail.com>
|
|
Reviewed-by: Jarod Wilson <jarod@redhat.com>
|
|
Acked-by: Jarod Wilson <jarod@redhat.com>
|
|
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
|
|
Signed-off-by: Jarod Wilson <jarod@redhat.com>
|
|
---
|
|
drivers/lirc_dev/lirc_dev.c | 24 ++++++++++++++----------
|
|
1 file changed, 14 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/drivers/lirc_dev/lirc_dev.c b/drivers/lirc_dev/lirc_dev.c
|
|
index 95ba25e..96c9148 100644
|
|
--- a/drivers/lirc_dev/lirc_dev.c
|
|
+++ b/drivers/lirc_dev/lirc_dev.c
|
|
@@ -769,18 +769,18 @@ ssize_t lirc_dev_fop_read(struct file *file,
|
|
if (!buf)
|
|
return -ENOMEM;
|
|
|
|
- if (mutex_lock_interruptible(&ir->irctl_lock))
|
|
- return -ERESTARTSYS;
|
|
+ if (mutex_lock_interruptible(&ir->irctl_lock)) {
|
|
+ ret = -ERESTARTSYS;
|
|
+ goto out_unlocked;
|
|
+ }
|
|
if (!ir->attached) {
|
|
- mutex_unlock(&ir->irctl_lock);
|
|
- return -ENODEV;
|
|
+ ret = -ENODEV;
|
|
+ goto out_locked;
|
|
}
|
|
|
|
if (length % ir->chunk_size) {
|
|
- dprintk(LOGHEAD "read result = -EINVAL\n",
|
|
- ir->d.name, ir->d.minor);
|
|
- mutex_unlock(&ir->irctl_lock);
|
|
- return -EINVAL;
|
|
+ ret = -EINVAL;
|
|
+ goto out_locked;
|
|
}
|
|
|
|
/*
|
|
@@ -831,19 +831,23 @@ ssize_t lirc_dev_fop_read(struct file *file,
|
|
lirc_buffer_read(ir->buf, buf);
|
|
ret = copy_to_user((void *)buffer+written, buf,
|
|
ir->buf->chunk_size);
|
|
- written += ir->buf->chunk_size;
|
|
+ if (!ret)
|
|
+ written += ir->buf->chunk_size;
|
|
+ else
|
|
+ ret = -EFAULT;
|
|
}
|
|
}
|
|
|
|
remove_wait_queue(&ir->buf->wait_poll, &wait);
|
|
set_current_state(TASK_RUNNING);
|
|
|
|
+out_locked:
|
|
mutex_unlock(&ir->irctl_lock);
|
|
|
|
out_unlocked:
|
|
kfree(buf);
|
|
dprintk(LOGHEAD "read result = %s (%d)\n",
|
|
- ir->d.name, ir->d.minor, ret ? "-EFAULT" : "OK", ret);
|
|
+ ir->d.name, ir->d.minor, ret ? "<fail>" : "OK", ret);
|
|
|
|
return ret ? ret : written;
|
|
}
|
|
--
|
|
1.8.3.1
|
|
|