summaryrefslogtreecommitdiff
path: root/drivers/media/IR
diff options
context:
space:
mode:
authorJarod Wilson <jarod@redhat.com>2010-07-07 11:29:44 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2010-08-02 15:36:23 -0300
commit69c271f33b949a7b1cbe6f7f39ce3db9e80997a2 (patch)
treedc391ef2781be95fa7b2da6220ea0e29fca32f11 /drivers/media/IR
parent89d328d5782cb7efebe733fb994aac4bc64c255a (diff)
V4L/DVB: IR/lirc_dev: fix locking in lirc_dev_fop_read
On Wed, Jul 07, 2010 at 02:52:58PM +0200, Jiri Slaby wrote: > Hi, > > stanse found a locking error in lirc_dev_fop_read: > if (mutex_lock_interruptible(&ir->irctl_lock)) > return -ERESTARTSYS; > ... > while (written < length && ret == 0) { > if (mutex_lock_interruptible(&ir->irctl_lock)) { #1 > ret = -ERESTARTSYS; > break; > } > ... > } > > remove_wait_queue(&ir->buf->wait_poll, &wait); > set_current_state(TASK_RUNNING); > mutex_unlock(&ir->irctl_lock); #2 > > If lock at #1 fails, it beaks out of the loop, with the lock unlocked, > but there is another "unlock" at #2. This should do the trick. Completely untested beyond compiling, but its not exactly a complicated fix, and in practice, I'm not aware of anyone ever actually tripping that locking bug, so there's zero functional change in typical use here. Signed-off-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/IR')
-rw-r--r--drivers/media/IR/lirc_dev.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/media/IR/lirc_dev.c b/drivers/media/IR/lirc_dev.c
index 9e141d51df91..64170fa58006 100644
--- a/drivers/media/IR/lirc_dev.c
+++ b/drivers/media/IR/lirc_dev.c
@@ -657,7 +657,9 @@ ssize_t lirc_dev_fop_read(struct file *file,
if (mutex_lock_interruptible(&ir->irctl_lock)) {
ret = -ERESTARTSYS;
- break;
+ remove_wait_queue(&ir->buf->wait_poll, &wait);
+ set_current_state(TASK_RUNNING);
+ goto out_unlocked;
}
if (!ir->attached) {
@@ -676,6 +678,7 @@ ssize_t lirc_dev_fop_read(struct file *file,
set_current_state(TASK_RUNNING);
mutex_unlock(&ir->irctl_lock);
+out_unlocked:
dev_dbg(ir->d.dev, LOGHEAD "read result = %s (%d)\n",
ir->d.name, ir->d.minor, ret ? "-EFAULT" : "OK", ret);