From 98c1ce0ccff1617cba45e8ead236768a50545e7f Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Fri, 23 Mar 2018 07:51:07 -0400 Subject: media: cec-core: fix a bug at cec_error_inj_write() If the adapter doesn't have error_inj_parse_line() ops, the write() logic won't return -EINVAL, but, instead, it will keep looping, because "count" is a non-negative number. Reviewed-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/cec/cec-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/media/cec/cec-core.c') diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c index ea3eccfdba15..b0c87f9ea08f 100644 --- a/drivers/media/cec/cec-core.c +++ b/drivers/media/cec/cec-core.c @@ -209,14 +209,14 @@ static ssize_t cec_error_inj_write(struct file *file, if (IS_ERR(buf)) return PTR_ERR(buf); p = buf; - while (p && *p && count >= 0) { + while (p && *p) { p = skip_spaces(p); line = strsep(&p, "\n"); if (!*line || *line == '#') continue; if (!adap->ops->error_inj_parse_line(adap, line)) { - count = -EINVAL; - break; + kfree(buf); + return -EINVAL; } } kfree(buf); -- cgit v1.2.3