From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from static-ip-62-75-166-246.inaddr.intergenia.de ([62.75.166.246]:33148 "EHLO vs166246.vserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751030AbXJ1OSN (ORCPT ); Sun, 28 Oct 2007 10:18:13 -0400 From: Michael Buesch To: John Linville Subject: [PATCH] rfkill: Use mutex_lock() at register and add sanity check Date: Sun, 28 Oct 2007 15:16:50 +0100 Cc: Ivo van Doorn , linux-wireless@vger.kernel.org MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Message-Id: <200710281516.51356.mb@bu3sch.de> (sfid-20071028_141817_338229_556766AB) Sender: linux-wireless-owner@vger.kernel.org List-ID: Replace mutex_lock_interruptible() by mutex_lock() in rfkill_register(), as interruptible doesn't make sense there. Add a sanity check for rfkill->type, as that's used for an unchecked dereference in an array and might cause hard to debug crashes if the driver sets this to an invalid value. Signed-off-by: Michael Buesch Index: wireless-2.6/net/rfkill/rfkill.c =================================================================== --- wireless-2.6.orig/net/rfkill/rfkill.c 2007-10-28 14:27:30.000000000 +0100 +++ wireless-2.6/net/rfkill/rfkill.c 2007-10-28 15:07:11.000000000 +0100 @@ -276,21 +276,17 @@ static struct class rfkill_class = { static int rfkill_add_switch(struct rfkill *rfkill) { - int retval; - - retval = mutex_lock_interruptible(&rfkill_mutex); - if (retval) - return retval; + int error; - retval = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]); - if (retval) - goto out; + mutex_lock(&rfkill_mutex); - list_add_tail(&rfkill->node, &rfkill_list); + error = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]); + if (!error) + list_add_tail(&rfkill->node, &rfkill_list); - out: mutex_unlock(&rfkill_mutex); - return retval; + + return error; } static void rfkill_remove_switch(struct rfkill *rfkill) @@ -387,6 +383,8 @@ int rfkill_register(struct rfkill *rfkil if (!rfkill->toggle_radio) return -EINVAL; + if (rfkill->type >= RFKILL_TYPE_MAX) + return -EINVAL; snprintf(dev->bus_id, sizeof(dev->bus_id), "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);