Videopix Frame Grabber: vfc_debug() doesn't release the device lock
when copy_from_user() fails
Signed-off-by: Matthias Kaehlcke <matthias.kaehlcke@xxxxxxxxx>
---
diff --git a/drivers/sbus/char/vfc_dev.c b/drivers/sbus/char/vfc_dev.c
index 6afc7e5..1cbdabd 100644
--- a/drivers/sbus/char/vfc_dev.c
+++ b/drivers/sbus/char/vfc_dev.c
@@ -248,6 +248,7 @@ static int vfc_debug(struct vfc_dev *dev, int cmd, void __user *argp)
buffer,inout.len);
if (copy_to_user(argp,&inout,sizeof(inout))) {
+ vfc_unlock_device(dev);
kfree(buffer);
return -EFAULT;
}
--
Matthias Kaehlcke
Linux Application Developer
Barcelona
Usually when people are sad, they don't do anything. They just cry over
their condition. But when they get angry, they bring about a change
(Malcolm X)
.''`.
using free software / Debian GNU/Linux | http://debian.org : :' :
`. `'`
gpg --keyserver pgp.mit.edu --recv-keys 47D8E5D4 `-
-
To unsubscribe from this list: send the line "unsubscribe sparclinux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
