media: ttusb-dec: avoid release of non-acquired mutex

[ Upstream commit 36b9d695aa6fb8e9a312db21af41f90824d16ab4 ]

ttusb_dec_send_command() invokes mutex_lock_interruptible() that can
fail but then it releases the non-acquired mutex. The patch fixes that.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: dba328bab4c6 ("media: ttusb-dec: cleanup an error handling logic")
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
index bfda46a36dc50b7a20ddfd7f2a4334d1442a44bc..38822cedd93a97c23486de57fa8931f9723f92fa 100644 (file)
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -327,7 +327,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
        result = mutex_lock_interruptible(&dec->usb_mutex);
        if (result) {
                printk("%s: Failed to lock usb mutex.\n", __func__);
-               goto err;
+               goto err_free;
        }
 
        b[0] = 0xaa;
@@ -349,7 +349,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
        if (result) {
                printk("%s: command bulk message failed: error %d\n",
                       __func__, result);
-               goto err;
+               goto err_mutex_unlock;
        }
 
        result = usb_bulk_msg(dec->udev, dec->result_pipe, b,
@@ -358,7 +358,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
        if (result) {
                printk("%s: result bulk message failed: error %d\n",
                       __func__, result);
-               goto err;
+               goto err_mutex_unlock;
        } else {
                if (debug) {
                        printk(KERN_DEBUG "%s: result: %*ph\n",
@@ -371,9 +371,9 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
                        memcpy(cmd_result, &b[4], b[3]);
        }
 
-err:
+err_mutex_unlock:
        mutex_unlock(&dec->usb_mutex);
-
+err_free:
        kfree(b);
        return result;
 }