summaryrefslogtreecommitdiffstats
path: root/net/rfkill
diff options
context:
space:
mode:
authorMichael Buesch <mb@bu3sch.de>2007-10-28 15:16:50 +0100
committerDavid S. Miller <davem@sunset.davemloft.net>2007-11-10 22:00:15 -0800
commit7319f1e6bcf04abd2eddb19747b0933a76f839ce (patch)
treeb6b1579a2bf0bfab90736ee589fa836835ede6cc /net/rfkill
parentf51359a8fb1bb00ae87051991e59d0f92d90604b (diff)
downloadlinux-7319f1e6bcf04abd2eddb19747b0933a76f839ce.tar.bz2
rfkill: Use mutex_lock() at register and add sanity check
Replace mutex_lock_interruptible() by mutex_lock() in rfkill_register(), as interruptible doesn't make sense there. Add a sanity check for rfkill->type, as that's used for an unchecked dereference in an array and might cause hard to debug crashes if the driver sets this to an invalid value. Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/rfkill')
-rw-r--r--net/rfkill/rfkill.c20
1 files changed, 9 insertions, 11 deletions
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index bbfbb9e7a917..47e8cd0322c0 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -276,21 +276,17 @@ static struct class rfkill_class = {
static int rfkill_add_switch(struct rfkill *rfkill)
{
- int retval;
-
- retval = mutex_lock_interruptible(&rfkill_mutex);
- if (retval)
- return retval;
+ int error;
- retval = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);
- if (retval)
- goto out;
+ mutex_lock(&rfkill_mutex);
- list_add_tail(&rfkill->node, &rfkill_list);
+ error = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);
+ if (!error)
+ list_add_tail(&rfkill->node, &rfkill_list);
- out:
mutex_unlock(&rfkill_mutex);
- return retval;
+
+ return error;
}
static void rfkill_remove_switch(struct rfkill *rfkill)
@@ -387,6 +383,8 @@ int rfkill_register(struct rfkill *rfkill)
if (!rfkill->toggle_radio)
return -EINVAL;
+ if (rfkill->type >= RFKILL_TYPE_MAX)
+ return -EINVAL;
snprintf(dev->bus_id, sizeof(dev->bus_id),
"rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);