[PATCH] virtio: nsm: fix raw ioctl copy error path

From: Yousef Alhouseen

Date: Wed Jun 24 2026 - 13:35:53 EST


nsm_dev_ioctl() uses a common exit path which unlocks nsm->lock.

A failed copy_from_user() reaches that path before the mutex is locked.

Return -EFAULT directly for that pre-lock failure.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
---
drivers/misc/nsm.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index ef7b32742..e39ff0071 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -365,9 +365,8 @@ static long nsm_dev_ioctl(struct file *file, unsigned int cmd,
return -EINVAL;

/* Copy user argument struct to kernel argument struct */
- r = -EFAULT;
if (copy_from_user(&raw, argp, _IOC_SIZE(cmd)))
- goto out;
+ return -EFAULT;

mutex_lock(&nsm->lock);

--
2.54.0