diff options
| author | Michael Buesch <mb@bu3sch.de> | 2007-10-28 15:16:50 +0100 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2007-11-10 22:00:15 -0800 |
| commit | 7319f1e6bcf04abd2eddb19747b0933a76f839ce (patch) | |
| tree | b6b1579a2bf0bfab90736ee589fa836835ede6cc /net/rfkill | |
| parent | f51359a8fb1bb00ae87051991e59d0f92d90604b (diff) | |
| download | linux-7319f1e6bcf04abd2eddb19747b0933a76f839ce.tar.gz | |
rfkill: Use mutex_lock() at register and add sanity check
Replace mutex_lock_interruptible() by mutex_lock() in rfkill_register(), as interruptible doesn't make sense there. Add a sanity check for rfkill->type, as that's used for an unchecked dereference in an array and might cause hard to debug crashes if the driver sets this to an invalid value. Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/rfkill')
| -rw-r--r-- | net/rfkill/rfkill.c | 20 |
1 files changed, 9 insertions, 11 deletions
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c index bbfbb9e7a917..47e8cd0322c0 100644 --- a/net/rfkill/rfkill.c +++ b/net/rfkill/rfkill.c @@ -276,21 +276,17 @@ static struct class rfkill_class = { static int rfkill_add_switch(struct rfkill *rfkill) { - int retval; - - retval = mutex_lock_interruptible(&rfkill_mutex); - if (retval) - return retval; + int error; - retval = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]); - if (retval) - goto out; + mutex_lock(&rfkill_mutex); - list_add_tail(&rfkill->node, &rfkill_list); + error = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]); + if (!error) + list_add_tail(&rfkill->node, &rfkill_list); - out: mutex_unlock(&rfkill_mutex); - return retval; + + return error; } static void rfkill_remove_switch(struct rfkill *rfkill) @@ -387,6 +383,8 @@ int rfkill_register(struct rfkill *rfkill) if (!rfkill->toggle_radio) return -EINVAL; + if (rfkill->type >= RFKILL_TYPE_MAX) + return -EINVAL; snprintf(dev->bus_id, sizeof(dev->bus_id), "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1); |