IOCTL: Unlock before freeing memory if transaction submission failed
Since transaction submission failed, the transaction data struct will
not be used by any other blocks anymore. It is safe to first release the
spinlock, then copy to user and release the memory.
Bug: 197431438
Test: CTS and GCA
Signed-off-by: Edmond Chung <edmondchung@google.com>
Change-Id: I1054d0591b6ca55ae7d192b46e535a1ae0fdde00
diff --git a/lwis_ioctl.c b/lwis_ioctl.c
index e05f3cc..97e51c2 100644
--- a/lwis_ioctl.c
+++ b/lwis_ioctl.c
@@ -986,12 +986,12 @@
ret = lwis_transaction_submit_locked(client, k_transaction);
if (ret) {
k_transaction->info.id = LWIS_ID_INVALID;
+ spin_unlock_irqrestore(&client->transaction_lock, flags);
if (copy_to_user((void __user *)msg, &k_transaction->info,
sizeof(struct lwis_transaction_info))) {
dev_err_ratelimited(lwis_dev->dev, "Failed to return info to userspace\n");
}
free_transaction(k_transaction);
- spin_unlock_irqrestore(&client->transaction_lock, flags);
return ret;
}
@@ -1023,12 +1023,12 @@
ret = lwis_transaction_replace_locked(client, k_transaction);
if (ret) {
k_transaction->info.id = LWIS_ID_INVALID;
+ spin_unlock_irqrestore(&client->transaction_lock, flags);
if (copy_to_user((void __user *)msg, &k_transaction->info,
sizeof(struct lwis_transaction_info))) {
dev_err_ratelimited(lwis_dev->dev, "Failed to return info to userspace\n");
}
free_transaction(k_transaction);
- spin_unlock_irqrestore(&client->transaction_lock, flags);
return ret;
}
