[PATCH 08/13] rapidio: fix error handling in mbox request/release functions

[Alexandre Bounine]

Add checking for error code returned by HW-specific mbox open routines.
Ensure that resources are properly release if failed.

This patch is applicable to kernel versions starting from v2.6.15.

Signed-off-by: Alexandre Bounine <alexandre.boun...@idt.com>
Cc: Matt Porter <mpor...@kernel.crashing.org>
Cc: Andre van Herk <andre.van.h...@prodrive-technologies.com>
Cc: Barry Wood <barry.w...@idt.com>
Cc: linux-kernel@vger.kernel.org
---
 drivers/rapidio/rio.c |   54 ++++++++++++++++++++++++++++++++++++++----------
 1 files changed, 42 insertions(+), 12 deletions(-)

diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index 8408029..1cd3260 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -268,6 +268,12 @@ int rio_request_inb_mbox(struct rio_mport *mport,
                mport->inb_msg[mbox].mcback = minb;
 
                rc = mport->ops->open_inb_mbox(mport, dev_id, mbox, entries);
+               if (rc) {
+                       mport->inb_msg[mbox].mcback = NULL;
+                       mport->inb_msg[mbox].res = NULL;
+                       release_resource(res);
+                       kfree(res);
+               }
        } else
                rc = -ENOMEM;
 
@@ -285,13 +291,22 @@ int rio_request_inb_mbox(struct rio_mport *mport,
  */
 int rio_release_inb_mbox(struct rio_mport *mport, int mbox)
 {
-       if (mport->ops->close_inb_mbox) {
-               mport->ops->close_inb_mbox(mport, mbox);
+       int rc;
 
-               /* Release the mailbox resource */
-               return release_resource(mport->inb_msg[mbox].res);
-       } else
-               return -ENOSYS;
+       if (!mport->ops->close_inb_mbox || !mport->inb_msg[mbox].res)
+               return -EINVAL;
+
+       mport->ops->close_inb_mbox(mport, mbox);
+       mport->inb_msg[mbox].mcback = NULL;
+
+       rc = release_resource(mport->inb_msg[mbox].res);
+       if (rc)
+               return rc;
+
+       kfree(mport->inb_msg[mbox].res);
+       mport->inb_msg[mbox].res = NULL;
+
+       return 0;
 }
 
 /**
@@ -336,6 +351,12 @@ int rio_request_outb_mbox(struct rio_mport *mport,
                mport->outb_msg[mbox].mcback = moutb;
 
                rc = mport->ops->open_outb_mbox(mport, dev_id, mbox, entries);
+               if (rc) {
+                       mport->outb_msg[mbox].mcback = NULL;
+                       mport->outb_msg[mbox].res = NULL;
+                       release_resource(res);
+                       kfree(res);
+               }
        } else
                rc = -ENOMEM;
 
@@ -353,13 +374,22 @@ int rio_request_outb_mbox(struct rio_mport *mport,
  */
 int rio_release_outb_mbox(struct rio_mport *mport, int mbox)
 {
-       if (mport->ops->close_outb_mbox) {
-               mport->ops->close_outb_mbox(mport, mbox);
+       int rc;
 
-               /* Release the mailbox resource */
-               return release_resource(mport->outb_msg[mbox].res);
-       } else
-               return -ENOSYS;
+       if (!mport->ops->close_outb_mbox || !mport->outb_msg[mbox].res)
+               return -EINVAL;
+
+       mport->ops->close_outb_mbox(mport, mbox);
+       mport->outb_msg[mbox].mcback = NULL;
+
+       rc = release_resource(mport->outb_msg[mbox].res);
+       if (rc)
+               return rc;
+
+       kfree(mport->outb_msg[mbox].res);
+       mport->outb_msg[mbox].res = NULL;
+
+       return 0;
 }
 
 /**
-- 
1.7.8.4