Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

HID: unlock properly on error paths in hidraw_ioctl()

We can't return immediately because lock_kernel() is held.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

authored by

Dan Carpenter and committed by
Jiri Kosina
dfd395af 35cfd1d9

+9 -5
+9 -5
drivers/hid/hidraw.c
··· 267 267 default: 268 268 { 269 269 struct hid_device *hid = dev->hid; 270 - if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ) 271 - return -EINVAL; 270 + if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ) { 271 + ret = -EINVAL; 272 + break; 273 + } 272 274 273 275 if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) { 274 276 int len; ··· 279 277 len = strlen(hid->name) + 1; 280 278 if (len > _IOC_SIZE(cmd)) 281 279 len = _IOC_SIZE(cmd); 282 - return copy_to_user(user_arg, hid->name, len) ? 280 + ret = copy_to_user(user_arg, hid->name, len) ? 283 281 -EFAULT : len; 282 + break; 284 283 } 285 284 286 285 if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) { ··· 291 288 len = strlen(hid->phys) + 1; 292 289 if (len > _IOC_SIZE(cmd)) 293 290 len = _IOC_SIZE(cmd); 294 - return copy_to_user(user_arg, hid->phys, len) ? 291 + ret = copy_to_user(user_arg, hid->phys, len) ? 295 292 -EFAULT : len; 293 + break; 296 294 } 297 295 } 298 296 299 - ret = -ENOTTY; 297 + ret = -ENOTTY; 300 298 } 301 299 unlock_kernel(); 302 300 return ret;