Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79d75320 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

tty: double unlock on error in ptmx_open() 



The problem here is that we called mutex_unlock(&devpts_mutex) on the
error path when we weren't holding the lock.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 157a4b31

drivers/tty/pty.c

+1 −3
Original line number Original line Diff line number Diff line
@@ -618,13 +618,12 @@ static int ptmx_open(struct inode *inode, struct file *filp) 
	/* find a device that is not in use. */

	/* find a device that is not in use. */

	mutex_lock(&devpts_mutex);

	mutex_lock(&devpts_mutex);

	index = devpts_new_index(inode);

	index = devpts_new_index(inode);

	mutex_unlock(&devpts_mutex);

	if (index < 0) {

	if (index < 0) {

		retval = index;

		retval = index;

		goto err_file;

		goto err_file;

	}

	}





	mutex_unlock(&devpts_mutex);



	mutex_lock(&tty_mutex);

	mutex_lock(&tty_mutex);

	tty = tty_init_dev(ptm_driver, index);

	tty = tty_init_dev(ptm_driver, index);
@@ -659,7 +658,6 @@ out: 
	mutex_unlock(&tty_mutex);

	mutex_unlock(&tty_mutex);

	devpts_kill_index(inode, index);

	devpts_kill_index(inode, index);

err_file:

err_file:

        mutex_unlock(&devpts_mutex);

	tty_free_file(filp);

	tty_free_file(filp);

	return retval;

	return retval;

}

}