iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gpio: free handles in fringe cases

Browse Source 
If we fail when copying the ioctl() struct to userspace we still
need to clean up the cruft otherwise left behind or it will stay
around until the issuing process terminates the file handle.

Reported-by: Alexander Stein <alexander.stein@systec-electronic.com>
Acked-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
This commit is contained in:
Linus Walleij 2016-07-04 13:13:04 +02:00
parent a944a892aa
commit d932cd4918
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/gpio/gpiolib.c
View File

@ -488,8 +488,10 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
}
handlereq.fd = fd;
if (copy_to_user(ip, &handlereq, sizeof(handlereq)))
return -EFAULT;
if (copy_to_user(ip, &handlereq, sizeof(handlereq))) {
ret = -EFAULT;
goto out_free_descs;
}
dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
lh->numdescs);
@ -784,8 +786,10 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
}
eventreq.fd = fd;
if (copy_to_user(ip, &eventreq, sizeof(eventreq)))
return -EFAULT;
if (copy_to_user(ip, &eventreq, sizeof(eventreq))) {
ret = -EFAULT;
goto out_free_irq;
}
return 0;