diff mbox

gpio: free handles in fringe cases

Message ID 1467630885-3042-1-git-send-email-linus.walleij@linaro.org
State Accepted
Commit d932cd49182f97966d196fb5301bfca90f58a360
Headers show

Commit Message

Linus Walleij July 4, 2016, 11:14 a.m. UTC 
If we fail when copying the ioctl() struct to userspace we still
need to clean up the cruft otherwise left behind or it will stay
around until the issuing process terminates the file handle.

Reported-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>

---
 drivers/gpio/gpiolib.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

-- 
2.4.11

--
To unsubscribe from this list: send the line "unsubscribe linux-gpio" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index b195ec406ff4..69efe278f74d 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -488,8 +488,10 @@  static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 	}
 
 	handlereq.fd = fd;
-	if (copy_to_user(ip, &handlereq, sizeof(handlereq)))
-		return -EFAULT;
+	if (copy_to_user(ip, &handlereq, sizeof(handlereq))) {
+		ret = -EFAULT;
+		goto out_free_descs;
+	}
 
 	dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
 		lh->numdescs);
@@ -784,8 +786,10 @@  static int lineevent_create(struct gpio_device *gdev, void __user *ip)
 	}
 
 	eventreq.fd = fd;
-	if (copy_to_user(ip, &eventreq, sizeof(eventreq)))
-		return -EFAULT;
+	if (copy_to_user(ip, &eventreq, sizeof(eventreq))) {
+		ret = -EFAULT;
+		goto out_free_irq;
+	}
 
 	return 0;