diff options
| author | Yonghua Zheng <younghua.zheng@gmail.com> | 2013-07-30 02:16:10 -0400 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2013-07-31 13:48:55 -0400 |
| commit | 8e552e535948fe8612d36a7beaf19519140bc285 (patch) | |
| tree | 72e448701c7f02aa85e9fedd1f828616f322f4b0 | |
| parent | 6f498018279d118cf38945f73da7c9345f7e2e5d (diff) | |
HID: hidraw: fix improper mutex release
Mutex can not be released unless all hid_device members are properly
initialized. Otherwise it would result in a race condition that can
cause NULL pointer kernel panic issue in hidraw_open where it uses
uninitialized 'list' member in list_add_tail().
Signed-off-by: Yonghua Zheng <younghua.zheng@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| -rw-r--r-- | drivers/hid/hidraw.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c index a7451632ceb4..6f1feb2c2e97 100644 --- a/drivers/hid/hidraw.c +++ b/drivers/hid/hidraw.c | |||
| @@ -518,7 +518,6 @@ int hidraw_connect(struct hid_device *hid) | |||
| 518 | goto out; | 518 | goto out; |
| 519 | } | 519 | } |
| 520 | 520 | ||
| 521 | mutex_unlock(&minors_lock); | ||
| 522 | init_waitqueue_head(&dev->wait); | 521 | init_waitqueue_head(&dev->wait); |
| 523 | INIT_LIST_HEAD(&dev->list); | 522 | INIT_LIST_HEAD(&dev->list); |
| 524 | 523 | ||
| @@ -528,6 +527,7 @@ int hidraw_connect(struct hid_device *hid) | |||
| 528 | dev->exist = 1; | 527 | dev->exist = 1; |
| 529 | hid->hidraw = dev; | 528 | hid->hidraw = dev; |
| 530 | 529 | ||
| 530 | mutex_unlock(&minors_lock); | ||
| 531 | out: | 531 | out: |
| 532 | return result; | 532 | return result; |
| 533 | 533 | ||
