diff mbox

[30/30] media: cec-core: fix a bug at cec_error_inj_write()

Message ID c1b1e1d6a1588d099720f8c6509736b01ccdc6ae.1521806166.git.mchehab@s-opensource.com (mailing list archive)
State New, archived
Headers show

Commit Message

Mauro Carvalho Chehab March 23, 2018, 11:57 a.m. UTC 
If the adapter doesn't have error_inj_parse_line() ops, the
write() logic won't return -EINVAL, but, instead, it will keep
looping, because "count" is a non-negative number.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
---
 drivers/media/cec/cec-core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Hans Verkuil (hansverk) March 23, 2018, 12:24 p.m. UTC | #1 
On 03/23/18 12:57, Mauro Carvalho Chehab wrote:
> If the adapter doesn't have error_inj_parse_line() ops, the
> write() logic won't return -EINVAL, but, instead, it will keep
> looping, because "count" is a non-negative number.
> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>

Thanks!

	Hans

> ---
>  drivers/media/cec/cec-core.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
> index ea3eccfdba15..b0c87f9ea08f 100644
> --- a/drivers/media/cec/cec-core.c
> +++ b/drivers/media/cec/cec-core.c
> @@ -209,14 +209,14 @@ static ssize_t cec_error_inj_write(struct file *file,
>  	if (IS_ERR(buf))
>  		return PTR_ERR(buf);
>  	p = buf;
> -	while (p && *p && count >= 0) {
> +	while (p && *p) {
>  		p = skip_spaces(p);
>  		line = strsep(&p, "\n");
>  		if (!*line || *line == '#')
>  			continue;
>  		if (!adap->ops->error_inj_parse_line(adap, line)) {
> -			count = -EINVAL;
> -			break;
> +			kfree(buf);
> +			return -EINVAL;
>  		}
>  	}
>  	kfree(buf);
>
diff mbox

Patch

diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
index ea3eccfdba15..b0c87f9ea08f 100644
--- a/drivers/media/cec/cec-core.c
+++ b/drivers/media/cec/cec-core.c
@@ -209,14 +209,14 @@  static ssize_t cec_error_inj_write(struct file *file,
 	if (IS_ERR(buf))
 		return PTR_ERR(buf);
 	p = buf;
-	while (p && *p && count >= 0) {
+	while (p && *p) {
 		p = skip_spaces(p);
 		line = strsep(&p, "\n");
 		if (!*line || *line == '#')
 			continue;
 		if (!adap->ops->error_inj_parse_line(adap, line)) {
-			count = -EINVAL;
-			break;
+			kfree(buf);
+			return -EINVAL;
 		}
 	}
 	kfree(buf);