Skip to contentSkip to conversation

MEDIA: lirc, improper locking

PATCH New Jiri Slaby 2 participants 3 messages Jul 7, 2010 Media (V4L/DVB)

lore
Share & tools
lore

Jiri Slaby

author
#0 lore raw

Hi,

stanse found a locking error in lirc_dev_fop_read:
if (mutex_lock_interruptible(&ir->irctl_lock))
return -ERESTARTSYS;
...
while (written < length && ret == 0) {
if (mutex_lock_interruptible(&ir->irctl_lock)) { #1

    ret = -ERESTARTSYS;
    break;

}
...
}

remove_wait_queue(&ir->buf->wait_poll, &wait);
set_current_state(TASK_RUNNING);
mutex_unlock(&ir->irctl_lock); #2

If lock at #1 fails, it beaks out of the loop, with the lock unlocked, but there is another "unlock" at #2.

regards,

Signature · 1 line
js
#1 lore raw
Quoted 14 lines · Jiri Slaby

Hi,

stanse found a locking error in lirc_dev_fop_read:
if (mutex_lock_interruptible(&ir->irctl_lock))
return -ERESTARTSYS;
...
while (written < length && ret == 0) {
if (mutex_lock_interruptible(&ir->irctl_lock)) { #1

    ret = -ERESTARTSYS;
    break;

}
...
}

Quoted 6 lines

remove_wait_queue(&ir->buf->wait_poll, &wait);
set_current_state(TASK_RUNNING);
mutex_unlock(&ir->irctl_lock); #2

If lock at #1 fails, it beaks out of the loop, with the lock unlocked, but there is another "unlock" at #2.

Yeah, ok, I see the problem there, should be able to get a patch to fix it in flight later today.

Thanks much,

Signature · 2 lines
Jarod Wilson
[email protected]
#2 lore raw

PATCH 1/1 IR/lirc_dev: fix locking in lirc_dev_fop_read

In reply to Jiri Slaby
Quoted 14 lines · Jiri Slaby

Hi,

stanse found a locking error in lirc_dev_fop_read:
if (mutex_lock_interruptible(&ir->irctl_lock))
return -ERESTARTSYS;
...
while (written < length && ret == 0) {
if (mutex_lock_interruptible(&ir->irctl_lock)) { #1

    ret = -ERESTARTSYS;
    break;

}
...
}

Quoted 6 lines

remove_wait_queue(&ir->buf->wait_poll, &wait);
set_current_state(TASK_RUNNING);
mutex_unlock(&ir->irctl_lock); #2

If lock at #1 fails, it beaks out of the loop, with the lock unlocked, but there is another "unlock" at #2.

This should do the trick. Completely untested beyond compiling, but its not exactly a complicated fix, and in practice, I'm not aware of anyone ever actually tripping that locking bug, so there's zero functional change in typical use here.

Signed-off-by Jarod Wilson <[email protected]>
---
 drivers/media/IR/lirc_dev.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)
drivers/media/IR/lirc_dev.c +4 -1
index 9e141d5..64170fa 100644
@@ -657,7 +657,9 @@ ssize_t lirc_dev_fop_read(struct file *file,
 
 			if (mutex_lock_interruptible(&ir->irctl_lock)) {
 				ret = -ERESTARTSYS;
-				break;
+				remove_wait_queue(&ir->buf->wait_poll, &wait);
+				set_current_state(TASK_RUNNING);
+				goto out_unlocked;
 			}
 
 			if (!ir->attached) {

@@ -676,6 +678,7 @@ ssize_t lirc_dev_fop_read(struct file *file,
 	set_current_state(TASK_RUNNING);
 	mutex_unlock(&ir->irctl_lock);
 
+out_unlocked:
 	dev_dbg(ir->d.dev, LOGHEAD "read result = %s (%d)\n",
 		ir->d.name, ir->d.minor, ret ? "-EFAULT" : "OK", ret);
Signature · 2 lines
Jarod Wilson
[email protected]