From patchwork Wed Jul 7 14:29:44 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarod Wilson X-Patchwork-Id: 3744 Return-path: Envelope-to: mchehab@infradead.org Delivery-date: Wed, 07 Jul 2010 14:36:49 +0000 Received: from bombadil.infradead.org [18.85.46.34] by pedra with IMAP (fetchmail-6.3.17) for (single-drop); Wed, 07 Jul 2010 11:41:56 -0300 (BRT) Received: from vger.kernel.org ([209.132.180.67]) by bombadil.infradead.org with esmtp (Exim 4.72 #1 (Red Hat Linux)) id 1OWVk1-0000Oi-5b; Wed, 07 Jul 2010 14:36:49 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756144Ab0GGOgU (ORCPT + 1 other); Wed, 7 Jul 2010 10:36:20 -0400 Received: from mx1.redhat.com ([209.132.183.28]:32770 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755979Ab0GGOgS (ORCPT ); Wed, 7 Jul 2010 10:36:18 -0400 Received: from int-mx08.intmail.prod.int.phx2.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o67EaHTm031149 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 7 Jul 2010 10:36:17 -0400 Received: from xavier.bos.redhat.com (xavier.bos.redhat.com [10.16.16.50]) by int-mx08.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o67EaGVp005168; Wed, 7 Jul 2010 10:36:16 -0400 Received: by xavier.bos.redhat.com (Postfix, from userid 501) id 85B5721D59; Wed, 7 Jul 2010 10:29:44 -0400 (EDT) Date: Wed, 7 Jul 2010 10:29:44 -0400 From: Jarod Wilson To: Jiri Slaby Cc: Mauro Carvalho Chehab , linux-media@vger.kernel.org, Linux kernel mailing list Subject: [PATCH] IR/lirc_dev: fix locking in lirc_dev_fop_read Message-ID: <20100707142944.GC29996@redhat.com> References: <4C3478AA.7070805@gmail.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <4C3478AA.7070805@gmail.com> User-Agent: Mutt/1.5.20 (2009-12-10) X-Scanned-By: MIMEDefang 2.67 on 10.5.11.21 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org On Wed, Jul 07, 2010 at 02:52:58PM +0200, Jiri Slaby wrote: > Hi, > > stanse found a locking error in lirc_dev_fop_read: > if (mutex_lock_interruptible(&ir->irctl_lock)) > return -ERESTARTSYS; > ... > while (written < length && ret == 0) { > if (mutex_lock_interruptible(&ir->irctl_lock)) { #1 > ret = -ERESTARTSYS; > break; > } > ... > } > > remove_wait_queue(&ir->buf->wait_poll, &wait); > set_current_state(TASK_RUNNING); > mutex_unlock(&ir->irctl_lock); #2 > > If lock at #1 fails, it beaks out of the loop, with the lock unlocked, > but there is another "unlock" at #2. This should do the trick. Completely untested beyond compiling, but its not exactly a complicated fix, and in practice, I'm not aware of anyone ever actually tripping that locking bug, so there's zero functional change in typical use here. Signed-off-by: Jarod Wilson --- drivers/media/IR/lirc_dev.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/drivers/media/IR/lirc_dev.c b/drivers/media/IR/lirc_dev.c index 9e141d5..64170fa 100644 --- a/drivers/media/IR/lirc_dev.c +++ b/drivers/media/IR/lirc_dev.c @@ -657,7 +657,9 @@ ssize_t lirc_dev_fop_read(struct file *file, if (mutex_lock_interruptible(&ir->irctl_lock)) { ret = -ERESTARTSYS; - break; + remove_wait_queue(&ir->buf->wait_poll, &wait); + set_current_state(TASK_RUNNING); + goto out_unlocked; } if (!ir->attached) { @@ -676,6 +678,7 @@ ssize_t lirc_dev_fop_read(struct file *file, set_current_state(TASK_RUNNING); mutex_unlock(&ir->irctl_lock); +out_unlocked: dev_dbg(ir->d.dev, LOGHEAD "read result = %s (%d)\n", ir->d.name, ir->d.minor, ret ? "-EFAULT" : "OK", ret);