| Message ID | 1460483692-25061-9-git-send-email-mathieu.poirier@linaro.org |
|---|---|
| State | New |
| Headers | show |
diff --git a/drivers/hwtracing/coresight/coresight-tmc.c b/drivers/hwtracing/coresight/coresight-tmc.c index ae336641518f..4d7b64f69389 100644 --- a/drivers/hwtracing/coresight/coresight-tmc.c +++ b/drivers/hwtracing/coresight/coresight-tmc.c @@ -121,13 +121,14 @@ static int tmc_open(struct inode *inode, struct file *file) struct tmc_drvdata, miscdev); int ret = 0; - if (drvdata->read_count++) + if (drvdata->read_count) goto out; ret = tmc_read_prepare(drvdata); if (ret) return ret; out: + drvdata->read_count++; nonseekable_open(inode, file); dev_dbg(drvdata->dev, "%s: successfully opened\n", __func__);
In function tmc_open(), if tmc_read_prepare() fails variable drvdata->read_count is not decremented, causing unwanted access to drvdata->buf and very likely, a crash dump. By moving the incrementation to a place where we know things are stable this kind of situation is avoided. Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> --- drivers/hwtracing/coresight/coresight-tmc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.5.0