Print this page
9576 hid_attach is missing one mutex_exit in error path
Reviewed by: Andrew Stormont <andyjstormont@gmail.com>
Reviewed by: Robert Mustacchi <rm@joyent.com>
Reviewed by: Yuri Pankov <yuripv@yuripv.net>
Approved by: Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/io/usb/clients/hid/hid.c
          +++ new/usr/src/uts/common/io/usb/clients/hid/hid.c
↓ open down ↓ 426 lines elided ↑ open up ↑
 427  427  
 428  428                  USB_DPRINTF_L2(PRINT_MASK_ATTA, hidp->hid_log_handle,
 429  429                      "no interrupt IN endpoint found");
 430  430  
 431  431                  goto fail;
 432  432          }
 433  433  
 434  434          mutex_enter(&hidp->hid_mutex);
 435  435          if (usb_ep_xdescr_fill(USB_EP_XDESCR_CURRENT_VERSION, dip, ep_data,
 436  436              &hidp->hid_ep_intr_xdescr) != USB_SUCCESS) {
      437 +                mutex_exit(&hidp->hid_mutex);
 437  438  
 438  439                  goto fail;
 439  440          }
 440  441  
 441  442          /*
 442  443           * Attempt to find the hid descriptor, it could be after interface
 443  444           * or after endpoint descriptors
 444  445           */
 445  446          if (hid_parse_hid_descr(&hidp->hid_hid_descr, USB_HID_DESCR_SIZE,
 446  447              altif_data, ep_data) != USB_HID_DESCR_SIZE) {
↓ open down ↓ 618 lines elided ↑ open up ↑
1065 1066  
1066 1067  /*
1067 1068   * hid_wput :
1068 1069   *      write put routine for the hid module
1069 1070   */
1070 1071  static int
1071 1072  hid_wput(queue_t *q, mblk_t *mp)
1072 1073  {
1073 1074          hid_state_t     *hidp = (hid_state_t *)q->q_ptr;
1074 1075          int             error = USB_SUCCESS;
1075      -        struct iocblk   *iocbp;
     1076 +        struct iocblk   *iocbp;
1076 1077          mblk_t          *datap;
1077 1078          int             direction;
1078 1079          struct copyresp *crp;
1079      -        queue_t         *tmpq;
     1080 +        queue_t         *tmpq;
1080 1081          int             flag;
1081 1082  
1082 1083          USB_DPRINTF_L4(PRINT_MASK_ALL, hidp->hid_log_handle,
1083 1084              "hid_wput: Begin");
1084 1085  
1085 1086          /* See if the upper module is passing the right thing */
1086 1087          ASSERT(mp != NULL);
1087 1088          ASSERT(mp->b_datap != NULL);
1088 1089  
1089 1090          switch (mp->b_datap->db_type) {
↓ open down ↓ 1479 lines elided ↑ open up ↑
2569 2570                  mutex_exit(&hidp->hid_mutex);
2570 2571  
2571 2572                  return (USB_FAILURE);
2572 2573          }
2573 2574  
2574 2575          if ((request_type & USB_DEV_REQ_DIR_MASK) == USB_DEV_REQ_HOST_TO_DEV) {
2575 2576                  ASSERT((length == 0) && (ctrl_req->ctrl_data == NULL));
2576 2577          }
2577 2578  
2578 2579          ctrl_req->ctrl_bmRequestType    = request_type;
2579      -        ctrl_req->ctrl_bRequest         = (uint8_t)request_request;
     2580 +        ctrl_req->ctrl_bRequest         = (uint8_t)request_request;
2580 2581          ctrl_req->ctrl_wValue           = hid_request->hid_req_wValue;
2581 2582          ctrl_req->ctrl_wIndex           = request_index;
2582 2583          ctrl_req->ctrl_wLength          = hid_request->hid_req_wLength;
2583 2584          /* host to device: create a msg from hid_req_data */
2584 2585          if ((request_type & USB_DEV_REQ_DIR_MASK) == USB_DEV_REQ_HOST_TO_DEV) {
2585 2586                  mblk_t *pblk = allocb(hid_request->hid_req_wLength, BPRI_HI);
2586 2587                  if (pblk == NULL) {
2587 2588                          usb_free_ctrl_req(ctrl_req);
2588 2589                          return (USB_FAILURE);
2589 2590                  }
↓ open down ↓ 812 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX