diff options
| author | Jarod Wilson <jarod@redhat.com> | 2010-07-07 16:29:44 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-08-02 20:36:23 +0200 |
| commit | 69c271f33b949a7b1cbe6f7f39ce3db9e80997a2 (patch) | |
| tree | dc391ef2781be95fa7b2da6220ea0e29fca32f11 /drivers/media/IR | |
| parent | V4L/DVB: Retrieve firmware for az6027 (diff) | |
| download | linux-69c271f33b949a7b1cbe6f7f39ce3db9e80997a2.tar.xz linux-69c271f33b949a7b1cbe6f7f39ce3db9e80997a2.zip | |
V4L/DVB: IR/lirc_dev: fix locking in lirc_dev_fop_read
On Wed, Jul 07, 2010 at 02:52:58PM +0200, Jiri Slaby wrote:
> Hi,
>
> stanse found a locking error in lirc_dev_fop_read:
> if (mutex_lock_interruptible(&ir->irctl_lock))
> return -ERESTARTSYS;
> ...
> while (written < length && ret == 0) {
> if (mutex_lock_interruptible(&ir->irctl_lock)) { #1
> ret = -ERESTARTSYS;
> break;
> }
> ...
> }
>
> remove_wait_queue(&ir->buf->wait_poll, &wait);
> set_current_state(TASK_RUNNING);
> mutex_unlock(&ir->irctl_lock); #2
>
> If lock at #1 fails, it beaks out of the loop, with the lock unlocked,
> but there is another "unlock" at #2.
This should do the trick. Completely untested beyond compiling, but its
not exactly a complicated fix, and in practice, I'm not aware of anyone
ever actually tripping that locking bug, so there's zero functional change
in typical use here.
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/IR')
| -rw-r--r-- | drivers/media/IR/lirc_dev.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/media/IR/lirc_dev.c b/drivers/media/IR/lirc_dev.c index 9e141d51df91..64170fa58006 100644 --- a/drivers/media/IR/lirc_dev.c +++ b/drivers/media/IR/lirc_dev.c @@ -657,7 +657,9 @@ ssize_t lirc_dev_fop_read(struct file *file, if (mutex_lock_interruptible(&ir->irctl_lock)) { ret = -ERESTARTSYS; - break; + remove_wait_queue(&ir->buf->wait_poll, &wait); + set_current_state(TASK_RUNNING); + goto out_unlocked; } if (!ir->attached) { @@ -676,6 +678,7 @@ ssize_t lirc_dev_fop_read(struct file *file, set_current_state(TASK_RUNNING); mutex_unlock(&ir->irctl_lock); +out_unlocked: dev_dbg(ir->d.dev, LOGHEAD "read result = %s (%d)\n", ir->d.name, ir->d.minor, ret ? "-EFAULT" : "OK", ret); |