Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7319f1e6bcf04abd2eddb19747b0933a76f839ce
Commit:     7319f1e6bcf04abd2eddb19747b0933a76f839ce
Parent:     f51359a8fb1bb00ae87051991e59d0f92d90604b
Author:     Michael Buesch <[EMAIL PROTECTED]>
AuthorDate: Sun Oct 28 15:16:50 2007 +0100
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Sat Nov 10 22:00:15 2007 -0800

    rfkill: Use mutex_lock() at register and add sanity check
    
    Replace mutex_lock_interruptible() by mutex_lock() in rfkill_register(),
    as interruptible doesn't make sense there.
    
    Add a sanity check for rfkill->type, as that's used for an unchecked 
dereference
    in an array and might cause hard to debug crashes if the driver sets this
    to an invalid value.
    
    Signed-off-by: Michael Buesch <[EMAIL PROTECTED]>
    Signed-off-by: Ivo van Doorn <[EMAIL PROTECTED]>
    Signed-off-by: John W. Linville <[EMAIL PROTECTED]>
---
 net/rfkill/rfkill.c |   20 +++++++++-----------
 1 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index bbfbb9e..47e8cd0 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -276,21 +276,17 @@ static struct class rfkill_class = {
 
 static int rfkill_add_switch(struct rfkill *rfkill)
 {
-       int retval;
-
-       retval = mutex_lock_interruptible(&rfkill_mutex);
-       if (retval)
-               return retval;
+       int error;
 
-       retval = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);
-       if (retval)
-               goto out;
+       mutex_lock(&rfkill_mutex);
 
-       list_add_tail(&rfkill->node, &rfkill_list);
+       error = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);
+       if (!error)
+               list_add_tail(&rfkill->node, &rfkill_list);
 
- out:
        mutex_unlock(&rfkill_mutex);
-       return retval;
+
+       return error;
 }
 
 static void rfkill_remove_switch(struct rfkill *rfkill)
@@ -387,6 +383,8 @@ int rfkill_register(struct rfkill *rfkill)
 
        if (!rfkill->toggle_radio)
                return -EINVAL;
+       if (rfkill->type >= RFKILL_TYPE_MAX)
+               return -EINVAL;
 
        snprintf(dev->bus_id, sizeof(dev->bus_id),
                 "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to