Videopix Frame Grabber: vfc_debug() doesn't release the device lock when copy_from_user() fails Signed-off-by: Matthias Kaehlcke <matthias.kaehlcke@gmail.com> Acked-by: "David S. Miller" <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
@@ -248,6 +248,7 @@ static int vfc_debug(struct vfc_dev *dev, int cmd, void __user *argp)
buffer,inout.len);
if (copy_to_user(argp,&inout,sizeof(inout))) {
+ vfc_unlock_device(dev);
kfree(buffer);
return -EFAULT;
}