Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ac188b1 authored by Dan Carpenter's avatar Dan Carpenter Committed by Linus Torvalds
Browse files

drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() 

If riocm_get_channel() fails, then we should just return -EINVAL.
Calling riocm_put_channel() will trigger a NULL dereference and
generally we should call put() if the get() didn't succeed.

Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam


Fixes: b6e8d4aa ("rapidio: add RapidIO channelized messaging driver")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alexandre.bounine@idt.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 4b047002

drivers/rapidio/rio_cm.c

+3 −1
Original line number Diff line number Diff line
@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id) 
	riocm_debug(CHOP, "(ch_%d)", ch_id);



	ch = riocm_get_channel(ch_id);

	if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))

	if (!ch)

		return -EINVAL;

	if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))

		ret = -EINVAL;

	riocm_put_channel(ch);

	return ret;