2013-08-05 20:16:49

by Alexey Khoroshilov

Subject: [PATCH] [media] gspca: fix dev_open() error path

If v4l2_fh_open() fails in dev_open(), gspca_dev->module left locked.
The patch adds module_put(gspca_dev->module) on this path.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <[email protected]>
---
drivers/media/usb/gspca/gspca.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index b7ae872..048507b 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -1266,6 +1266,7 @@ static void gspca_release(struct v4l2_device *v4l2_device)
static int dev_open(struct file *file)
{
struct gspca_dev *gspca_dev = video_drvdata(file);
+ int ret;

PDEBUG(D_STREAM, "[%s] open", current->comm);

@@ -1273,7 +1274,10 @@ static int dev_open(struct file *file)
if (!try_module_get(gspca_dev->module))
return -ENODEV;

- return v4l2_fh_open(file);
+ ret = v4l2_fh_open(file);
+ if (ret)
+ module_put(gspca_dev->module);
+ return ret;
}

static int dev_close(struct file *file)
--
1.8.1.2

2013-08-20 12:20:38

by Hans de Goede

Subject: Re: [PATCH] [media] gspca: fix dev_open() error path

Hi,

Thanks for the patch I've added this to my "gspca" tree, and this
will be included in my next pull-request to Mauro for 3.12

Regards,

Hans

On 08/05/2013 10:16 PM, Alexey Khoroshilov wrote:
> If v4l2_fh_open() fails in dev_open(), gspca_dev->module left locked.
> The patch adds module_put(gspca_dev->module) on this path.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov<[email protected]>
> ---
> drivers/media/usb/gspca/gspca.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
> index b7ae872..048507b 100644
> --- a/drivers/media/usb/gspca/gspca.c
> +++ b/drivers/media/usb/gspca/gspca.c
> @@ -1266,6 +1266,7 @@ static void gspca_release(struct v4l2_device *v4l2_device)
> static int dev_open(struct file *file)
> {
> struct gspca_dev *gspca_dev = video_drvdata(file);
> + int ret;
>
> PDEBUG(D_STREAM, "[%s] open", current->comm);
>
> @@ -1273,7 +1274,10 @@ static int dev_open(struct file *file)
> if (!try_module_get(gspca_dev->module))
> return -ENODEV;
>
> - return v4l2_fh_open(file);
> + ret = v4l2_fh_open(file);
> + if (ret)
> + module_put(gspca_dev->module);
> + return ret;
> }
>
> static int dev_close(struct file *file)
> -- 1.8.1.2
>