Commit 7319f1e6 authored by Michael Buesch's avatar Michael Buesch Committed by David S. Miller

rfkill: Use mutex_lock() at register and add sanity check

Replace mutex_lock_interruptible() by mutex_lock() in rfkill_register(),
as interruptible doesn't make sense there.

Add a sanity check for rfkill->type, as that's used for an unchecked dereference
in an array and might cause hard to debug crashes if the driver sets this
to an invalid value.
Signed-off-by: default avatarMichael Buesch <mb@bu3sch.de>
Signed-off-by: default avatarIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent f51359a8
...@@ -276,21 +276,17 @@ static struct class rfkill_class = { ...@@ -276,21 +276,17 @@ static struct class rfkill_class = {
static int rfkill_add_switch(struct rfkill *rfkill) static int rfkill_add_switch(struct rfkill *rfkill)
{ {
int retval; int error;
retval = mutex_lock_interruptible(&rfkill_mutex);
if (retval)
return retval;
retval = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]); mutex_lock(&rfkill_mutex);
if (retval)
goto out;
list_add_tail(&rfkill->node, &rfkill_list); error = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);
if (!error)
list_add_tail(&rfkill->node, &rfkill_list);
out:
mutex_unlock(&rfkill_mutex); mutex_unlock(&rfkill_mutex);
return retval;
return error;
} }
static void rfkill_remove_switch(struct rfkill *rfkill) static void rfkill_remove_switch(struct rfkill *rfkill)
...@@ -387,6 +383,8 @@ int rfkill_register(struct rfkill *rfkill) ...@@ -387,6 +383,8 @@ int rfkill_register(struct rfkill *rfkill)
if (!rfkill->toggle_radio) if (!rfkill->toggle_radio)
return -EINVAL; return -EINVAL;
if (rfkill->type >= RFKILL_TYPE_MAX)
return -EINVAL;
snprintf(dev->bus_id, sizeof(dev->bus_id), snprintf(dev->bus_id, sizeof(dev->bus_id),
"rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1); "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment