Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d932cd49 authored by Linus Walleij's avatar Linus Walleij
Browse files

gpio: free handles in fringe cases 



If we fail when copying the ioctl() struct to userspace we still
need to clean up the cruft otherwise left behind or it will stay
around until the issuing process terminates the file handle.

Reported-by: default avatarAlexander Stein <alexander.stein@systec-electronic.com>
Acked-by: default avatarAlexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent a944a892

drivers/gpio/gpiolib.c

+8 −4
Original line number Diff line number Diff line
@@ -488,8 +488,10 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) 
	}



	handlereq.fd = fd;

	if (copy_to_user(ip, &handlereq, sizeof(handlereq)))

		return -EFAULT;

	if (copy_to_user(ip, &handlereq, sizeof(handlereq))) {

		ret = -EFAULT;

		goto out_free_descs;

	}



	dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",

		lh->numdescs);
@@ -784,8 +786,10 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip) 
	}



	eventreq.fd = fd;

	if (copy_to_user(ip, &eventreq, sizeof(eventreq)))

		return -EFAULT;

	if (copy_to_user(ip, &eventreq, sizeof(eventreq))) {

		ret = -EFAULT;

		goto out_free_irq;

	}



	return 0;