linux-kernel - [PATCH] IR/lirc_dev: fix locking in lirc_dev_fop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 7 Jul 2010 10:29:44 -0400
From:	Jarod Wilson <jarod@...hat.com>
To:	Jiri Slaby <jirislaby@...il.com>
Cc:	Mauro Carvalho Chehab <mchehab@...hat.com>,
	linux-media@...r.kernel.org,
	Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: [PATCH] IR/lirc_dev: fix locking in lirc_dev_fop_read

On Wed, Jul 07, 2010 at 02:52:58PM +0200, Jiri Slaby wrote:
> Hi,
> 
> stanse found a locking error in lirc_dev_fop_read:
> if (mutex_lock_interruptible(&ir->irctl_lock))
>   return -ERESTARTSYS;
> ...
> while (written < length && ret == 0) {
>   if (mutex_lock_interruptible(&ir->irctl_lock)) {    #1
>     ret = -ERESTARTSYS;
>     break;
>   }
>   ...
> }
> 
> remove_wait_queue(&ir->buf->wait_poll, &wait);
> set_current_state(TASK_RUNNING);
> mutex_unlock(&ir->irctl_lock);                        #2
> 
> If lock at #1 fails, it beaks out of the loop, with the lock unlocked,
> but there is another "unlock" at #2.

This should do the trick. Completely untested beyond compiling, but its
not exactly a complicated fix, and in practice, I'm not aware of anyone
ever actually tripping that locking bug, so there's zero functional change
in typical use here.

Signed-off-by: Jarod Wilson <jarod@...hat.com>
---
 drivers/media/IR/lirc_dev.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/drivers/media/IR/lirc_dev.c b/drivers/media/IR/lirc_dev.c
index 9e141d5..64170fa 100644
--- a/drivers/media/IR/lirc_dev.c
+++ b/drivers/media/IR/lirc_dev.c
@@ -657,7 +657,9 @@ ssize_t lirc_dev_fop_read(struct file *file,
 
 			if (mutex_lock_interruptible(&ir->irctl_lock)) {
 				ret = -ERESTARTSYS;
-				break;
+				remove_wait_queue(&ir->buf->wait_poll, &wait);
+				set_current_state(TASK_RUNNING);
+				goto out_unlocked;
 			}
 
 			if (!ir->attached) {
@@ -676,6 +678,7 @@ ssize_t lirc_dev_fop_read(struct file *file,
 	set_current_state(TASK_RUNNING);
 	mutex_unlock(&ir->irctl_lock);
 
+out_unlocked:
 	dev_dbg(ir->d.dev, LOGHEAD "read result = %s (%d)\n",
 		ir->d.name, ir->d.minor, ret ? "-EFAULT" : "OK", ret);
 

-- 
Jarod Wilson
jarod@...hat.com

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/