Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7319f1e6 authored by Michael Buesch's avatar Michael Buesch Committed by David S. Miller
Browse files

rfkill: Use mutex_lock() at register and add sanity check 



Replace mutex_lock_interruptible() by mutex_lock() in rfkill_register(),
as interruptible doesn't make sense there.

Add a sanity check for rfkill->type, as that's used for an unchecked dereference
in an array and might cause hard to debug crashes if the driver sets this
to an invalid value.

Signed-off-by: default avatarMichael Buesch <mb@bu3sch.de>
Signed-off-by: default avatarIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent f51359a8

net/rfkill/rfkill.c

+9 −11
Original line number Diff line number Diff line
@@ -276,21 +276,17 @@ static struct class rfkill_class = { 


static int rfkill_add_switch(struct rfkill *rfkill)

{

	int retval;



	retval = mutex_lock_interruptible(&rfkill_mutex);

	if (retval)

		return retval;

	int error;



	retval = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);

	if (retval)

		goto out;

	mutex_lock(&rfkill_mutex);



	error = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);

	if (!error)

		list_add_tail(&rfkill->node, &rfkill_list);



 out:

	mutex_unlock(&rfkill_mutex);

	return retval;



	return error;

}



static void rfkill_remove_switch(struct rfkill *rfkill)
@@ -387,6 +383,8 @@ int rfkill_register(struct rfkill *rfkill) 


	if (!rfkill->toggle_radio)

		return -EINVAL;

	if (rfkill->type >= RFKILL_TYPE_MAX)

		return -EINVAL;



	snprintf(dev->bus_id, sizeof(dev->bus_id),

		 "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);