fail_function: Remove a redundant mutex unlock

Luo Meng · Alexei Starovoitov · commit 2801a5da5b25 · 2020-11-19T11:58:16.000-08:00
Fix a mutex_unlock() issue where before copy_from_user() is not called mutex_locked. Fixes: 4b1a29a ("error-injection: Support fault injection framework") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Luo Meng <luomeng12@huawei.com> Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Masami Hiramatsu <mhiramat@kernel.org> Link: https://lore.kernel.org/bpf/160570737118.263807.8358435412898356284.stgit@devnote2
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
@@ -253,7 +253,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
 
 	if (copy_from_user(buf, buffer, count)) {
 		ret = -EFAULT;
-		goto out;
+		goto out_free;
 	}
 	buf[count] = '\0';
 	sym = strstrip(buf);
@@ -307,8 +307,9 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
 		ret = count;
 	}
 out:
-	kfree(buf);
 	mutex_unlock(&fei_lock);
+out_free:
+	kfree(buf);
 	return ret;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -253,7 +253,7 @@ static ssize_t fei_write(struct file file, const char __user buffer,`
`253`	`253`
`254`	`254`	`if (copy_from_user(buf, buffer, count)) {`
`255`	`255`	`ret = -EFAULT;`
`256`		`- goto out;`
	`256`	`+ goto out_free;`
`257`	`257`	`}`
`258`	`258`	`buf[count] = '\0';`
`259`	`259`	`sym = strstrip(buf);`
`@@ -307,8 +307,9 @@ static ssize_t fei_write(struct file file, const char __user buffer,`
`307`	`307`	`ret = count;`
`308`	`308`	`}`
`309`	`309`	`out:`
`310`		`- kfree(buf);`
`311`	`310`	`mutex_unlock(&fei_lock);`
	`311`	`+out_free:`
	`312`	`+ kfree(buf);`
`312`	`313`	`return ret;`
`313`	`314`	`}`
`314`	`315`