* Re: MEDIA: lirc, improper locking
2010-07-07 12:52 MEDIA: lirc, improper locking Jiri Slaby
@ 2010-07-07 14:00 ` Jarod Wilson
2010-07-07 14:29 ` [PATCH] IR/lirc_dev: fix locking in lirc_dev_fop_read Jarod Wilson
1 sibling, 0 replies; 3+ messages in thread
From: Jarod Wilson @ 2010-07-07 14:00 UTC (permalink / raw)
To: Jiri Slaby; +Cc: Mauro Carvalho Chehab, linux-media, Linux kernel mailing list
On Wed, Jul 07, 2010 at 02:52:58PM +0200, Jiri Slaby wrote:
> Hi,
>
> stanse found a locking error in lirc_dev_fop_read:
> if (mutex_lock_interruptible(&ir->irctl_lock))
> return -ERESTARTSYS;
> ...
> while (written < length && ret == 0) {
> if (mutex_lock_interruptible(&ir->irctl_lock)) { #1
> ret = -ERESTARTSYS;
> break;
> }
> ...
> }
>
> remove_wait_queue(&ir->buf->wait_poll, &wait);
> set_current_state(TASK_RUNNING);
> mutex_unlock(&ir->irctl_lock); #2
>
> If lock at #1 fails, it beaks out of the loop, with the lock unlocked,
> but there is another "unlock" at #2.
Yeah, ok, I see the problem there, should be able to get a patch to fix it
in flight later today.
Thanks much,
--
Jarod Wilson
jarod@redhat.com
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH] IR/lirc_dev: fix locking in lirc_dev_fop_read
2010-07-07 12:52 MEDIA: lirc, improper locking Jiri Slaby
2010-07-07 14:00 ` Jarod Wilson
@ 2010-07-07 14:29 ` Jarod Wilson
1 sibling, 0 replies; 3+ messages in thread
From: Jarod Wilson @ 2010-07-07 14:29 UTC (permalink / raw)
To: Jiri Slaby; +Cc: Mauro Carvalho Chehab, linux-media, Linux kernel mailing list
On Wed, Jul 07, 2010 at 02:52:58PM +0200, Jiri Slaby wrote:
> Hi,
>
> stanse found a locking error in lirc_dev_fop_read:
> if (mutex_lock_interruptible(&ir->irctl_lock))
> return -ERESTARTSYS;
> ...
> while (written < length && ret == 0) {
> if (mutex_lock_interruptible(&ir->irctl_lock)) { #1
> ret = -ERESTARTSYS;
> break;
> }
> ...
> }
>
> remove_wait_queue(&ir->buf->wait_poll, &wait);
> set_current_state(TASK_RUNNING);
> mutex_unlock(&ir->irctl_lock); #2
>
> If lock at #1 fails, it beaks out of the loop, with the lock unlocked,
> but there is another "unlock" at #2.
This should do the trick. Completely untested beyond compiling, but its
not exactly a complicated fix, and in practice, I'm not aware of anyone
ever actually tripping that locking bug, so there's zero functional change
in typical use here.
Signed-off-by: Jarod Wilson <jarod@redhat.com>
---
drivers/media/IR/lirc_dev.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/drivers/media/IR/lirc_dev.c b/drivers/media/IR/lirc_dev.c
index 9e141d5..64170fa 100644
--- a/drivers/media/IR/lirc_dev.c
+++ b/drivers/media/IR/lirc_dev.c
@@ -657,7 +657,9 @@ ssize_t lirc_dev_fop_read(struct file *file,
if (mutex_lock_interruptible(&ir->irctl_lock)) {
ret = -ERESTARTSYS;
- break;
+ remove_wait_queue(&ir->buf->wait_poll, &wait);
+ set_current_state(TASK_RUNNING);
+ goto out_unlocked;
}
if (!ir->attached) {
@@ -676,6 +678,7 @@ ssize_t lirc_dev_fop_read(struct file *file,
set_current_state(TASK_RUNNING);
mutex_unlock(&ir->irctl_lock);
+out_unlocked:
dev_dbg(ir->d.dev, LOGHEAD "read result = %s (%d)\n",
ir->d.name, ir->d.minor, ret ? "-EFAULT" : "OK", ret);
--
Jarod Wilson
jarod@redhat.com
^ permalink raw reply related [flat|nested] 3+ messages in thread