forked from Minki/linux
4b18f08be0
`do_cmd_ioctl()` is called with the comedi device's mutex locked to process the `COMEDI_CMD` ioctl to set up comedi's asynchronous command handling on a comedi subdevice. `comedi_read()` and `comedi_write()` are the `read` and `write` handlers for the comedi device, but do not lock the mutex (for performance reasons, as some things can hold the mutex for quite a long time). There is a race condition if `comedi_read()` or `comedi_write()` is running at the same time and for the same file object and comedi subdevice as `do_cmd_ioctl()`. `do_cmd_ioctl()` sets the subdevice's `busy` pointer to the file object way before it sets the `SRF_RUNNING` flag in the subdevice's `runflags` member. `comedi_read() and `comedi_write()` check the subdevice's `busy` pointer is pointing to the current file object, then if the `SRF_RUNNING` flag is not set, will call `do_become_nonbusy()` to shut down the asyncronous command. Bad things can happen if the asynchronous command is being shutdown and set up at the same time. To prevent the race, don't set the `busy` pointer until after the `SRF_RUNNING` flag has been set. Also, make sure the mutex is held in `comedi_read()` and `comedi_write()` while calling `do_become_nonbusy()` in order to avoid moving the race condition to a point within that function. Change some error handling `goto cleanup` statements in `do_cmd_ioctl()` to simple `return -ERRFOO` statements as a result of changing when the `busy` pointer is set. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| android | ||
| asus_oled | ||
| bcm | ||
| btmtk_usb | ||
| ced1401 | ||
| comedi | ||
| cptm1217 | ||
| crystalhd | ||
| cxt1e1 | ||
| dgrp | ||
| dwc2 | ||
| echo | ||
| et131x | ||
| frontier | ||
| ft1000 | ||
| fwserial | ||
| gdm72xx | ||
| goldfish | ||
| iio | ||
| imx-drm | ||
| keucr | ||
| line6 | ||
| lustre | ||
| media | ||
| netlogic | ||
| nvec | ||
| octeon | ||
| octeon-usb | ||
| olpc_dcon | ||
| ozwpan | ||
| panel | ||
| phison | ||
| quickstart | ||
| rtl8187se | ||
| rtl8192e | ||
| rtl8192u | ||
| rtl8712 | ||
| rts5139 | ||
| sb105x | ||
| sbe-2t3e3 | ||
| sep | ||
| serqt_usb2 | ||
| silicom | ||
| slicoss | ||
| sm7xxfb | ||
| speakup | ||
| ste_rmi4 | ||
| tidspbridge | ||
| usbip | ||
| vme | ||
| vt6655 | ||
| vt6656 | ||
| winbond | ||
| wlags49_h2 | ||
| wlags49_h25 | ||
| wlan-ng | ||
| xgifb | ||
| zcache | ||
| zram | ||
| zsmalloc | ||
| Kconfig | ||
| Makefile | ||
| staging.c | ||