aboutsummaryrefslogtreecommitdiff
path: root/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
diff options
context:
space:
mode:
authorKevin Hilman <khilman@linaro.org>2015-12-17 08:47:57 -0800
committerKevin Hilman <khilman@linaro.org>2015-12-17 08:47:57 -0800
commit8b20b3796da06d8ada347c4eaf289c3127da155f (patch)
treecf5c1e1d8c177307df660f503743f8d5bfcd39a5 /drivers/media/usb/dvb-usb-v2/rtl28xxu.c
parent49bd04cb11e57c4cd4d2c00feca898537dd6db1f (diff)
parent419f2e2c67426866f3bdaab80caa6faa3a082ad6 (diff)
downloadlinux-linaro-stable-8b20b3796da06d8ada347c4eaf289c3127da155f.tar.gz
Merge tag 'v4.1.13-rt15' of git://git.kernel.org/pub/scm/linux/kernel/git/rt/linux-rt-devel into v4.1/topic/rt
v4.1.13-rt15
Diffstat (limited to 'drivers/media/usb/dvb-usb-v2/rtl28xxu.c')
-rw-r--r--drivers/media/usb/dvb-usb-v2/rtl28xxu.c15
1 files changed, 13 insertions, 2 deletions
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 895441fe90f7..e862554952c1 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -34,6 +34,14 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
unsigned int pipe;
u8 requesttype;
+ mutex_lock(&d->usb_mutex);
+
+ if (req->size > sizeof(dev->buf)) {
+ dev_err(&d->intf->dev, "too large message %u\n", req->size);
+ ret = -EINVAL;
+ goto err_mutex_unlock;
+ }
+
if (req->index & CMD_WR_FLAG) {
/* write */
memcpy(dev->buf, req->data, req->size);
@@ -50,14 +58,17 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
dvb_usb_dbg_usb_control_msg(d->udev, 0, requesttype, req->value,
req->index, dev->buf, req->size);
if (ret < 0)
- goto err;
+ goto err_mutex_unlock;
/* read request, copy returned data to return buf */
if (requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
memcpy(req->data, dev->buf, req->size);
+ mutex_unlock(&d->usb_mutex);
+
return 0;
-err:
+err_mutex_unlock:
+ mutex_unlock(&d->usb_mutex);
dev_dbg(&d->intf->dev, "failed=%d\n", ret);
return ret;
}