linux-kernel - [PATCH 2/9] V4L/DVB (5020): Fix: disable interrupts while at KM_BOUNCE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <20070115183705.PS5598290002@infradead.org>
Date:	Mon, 15 Jan 2007 16:37:05 -0200
From:	Mauro Carvalho Chehab <mchehab@...radead.org>
To:	LKML <linux-kernel@...r.kernel.org>
Cc:	V4L-DVB Maintainers <v4l-dvb-maintainer@...uxtv.org>,
	Mauro Carvalho Chehab <mchehab@...radead.org>
Subject: [PATCH 2/9] V4L/DVB (5020): Fix: disable interrupts while at
	KM_BOUNCE_READ


From: Mauro Carvalho Chehab <mchehab@...radead.org>

vivi.c uses the KM_BOUNCE_READ with local interrupts enabled. 
This means that if a disk interrupt occurs while vivi.c is using this
fixmap slot, the vivi.c driver will, upon return from that interrupt, find
that the fixmap slot now points at a different physical page.
The net result will probably be rare corruption of disk file contents,
because viv.c will now be altering the page which the disk code was
recently using. 

Thanks to Andrew Morton for pointing this.
Signed-off-by: Mauro Carvalho Chehab <mchehab@...radead.org>
---

 drivers/media/video/vivi.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c
index bacb311..d4cf556 100644
--- a/drivers/media/video/vivi.c
+++ b/drivers/media/video/vivi.c
@@ -270,10 +270,15 @@ static void gen_line(struct sg_to_addr t
 	char *p,*s,*basep;
 	struct page *pg;
 	u8   chr,r,g,b,color;
+	unsigned long flags;
+	spinlock_t spinlock;
+
+	spin_lock_init(&spinlock);
 
 	/* Get first addr pointed to pixel position */
 	oldpg=get_addr_pos(pos,pages,to_addr);
 	pg=pfn_to_page(sg_dma_address(to_addr[oldpg].sg) >> PAGE_SHIFT);
+	spin_lock_irqsave(&spinlock,flags);
 	basep = kmap_atomic(pg, KM_BOUNCE_READ)+to_addr[oldpg].sg->offset;
 
 	/* We will just duplicate the second pixel at the packet */
@@ -376,6 +381,8 @@ static void gen_line(struct sg_to_addr t
 
 end:
 	kunmap_atomic(basep, KM_BOUNCE_READ);
+	spin_unlock_irqrestore(&spinlock,flags);
+
 }
 static void vivi_fillbuff(struct vivi_dev *dev,struct vivi_buffer *buf)
 {

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/