summaryrefslogtreecommitdiff
path: root/drivers/gpio
diff options
context:
space:
mode:
authorLinus Walleij <linus.walleij@linaro.org>2016-07-04 13:13:04 +0200
committerLinus Walleij <linus.walleij@linaro.org>2016-07-04 16:54:36 +0200
commitd932cd49182f97966d196fb5301bfca90f58a360 (patch)
tree9a94e87c0723413c4a6319fa080e02bffdcee003 /drivers/gpio
parenta944a892aa8ddecf6e2df432e6965dc86d73e3aa (diff)
downloadlwn-d932cd49182f97966d196fb5301bfca90f58a360.tar.gz
lwn-d932cd49182f97966d196fb5301bfca90f58a360.zip
gpio: free handles in fringe cases
If we fail when copying the ioctl() struct to userspace we still need to clean up the cruft otherwise left behind or it will stay around until the issuing process terminates the file handle. Reported-by: Alexander Stein <alexander.stein@systec-electronic.com> Acked-by: Alexander Stein <alexander.stein@systec-electronic.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Diffstat (limited to 'drivers/gpio')
-rw-r--r--drivers/gpio/gpiolib.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index b195ec406ff4..69efe278f74d 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -488,8 +488,10 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
}
handlereq.fd = fd;
- if (copy_to_user(ip, &handlereq, sizeof(handlereq)))
- return -EFAULT;
+ if (copy_to_user(ip, &handlereq, sizeof(handlereq))) {
+ ret = -EFAULT;
+ goto out_free_descs;
+ }
dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
lh->numdescs);
@@ -784,8 +786,10 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
}
eventreq.fd = fd;
- if (copy_to_user(ip, &eventreq, sizeof(eventreq)))
- return -EFAULT;
+ if (copy_to_user(ip, &eventreq, sizeof(eventreq))) {
+ ret = -EFAULT;
+ goto out_free_irq;
+ }
return 0;