Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 54ad6412 authored by Martin Schwidefsky's avatar Martin Schwidefsky
Browse files

[S390] 3270: fix race with stack local wait_queue_head_t. 



A wait_event call with a stack local wait_queue_head_t structure that is
used to do the wake up for the wait_event is inherently racy. After the
wait_event finished the wake_up call might not have completed yet.
Remove the stack local wait_queue_head_t from raw3270_start_init and
use the global raw3270_wait_queue instead.

Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent c80ee724

drivers/s390/char/raw3270.c

+4 −5
Original line number Original line Diff line number Diff line
@@ -549,7 +549,6 @@ raw3270_start_init(struct raw3270 *rp, struct raw3270_view *view, 
		   struct raw3270_request *rq)

		   struct raw3270_request *rq)

{

{

	unsigned long flags;

	unsigned long flags;

	wait_queue_head_t wq;

	int rc;

	int rc;





#ifdef CONFIG_TN3270_CONSOLE

#ifdef CONFIG_TN3270_CONSOLE
@@ -566,20 +565,20 @@ raw3270_start_init(struct raw3270 *rp, struct raw3270_view *view, 
		return rq->rc;

		return rq->rc;

	}

	}

#endif

#endif

	init_waitqueue_head(&wq);

	rq->callback = raw3270_wake_init;

	rq->callback = raw3270_wake_init;

	rq->callback_data = &wq;

	rq->callback_data = &raw3270_wait_queue;

	spin_lock_irqsave(get_ccwdev_lock(view->dev->cdev), flags);

	spin_lock_irqsave(get_ccwdev_lock(view->dev->cdev), flags);

	rc = __raw3270_start(rp, view, rq);

	rc = __raw3270_start(rp, view, rq);

	spin_unlock_irqrestore(get_ccwdev_lock(view->dev->cdev), flags);

	spin_unlock_irqrestore(get_ccwdev_lock(view->dev->cdev), flags);

	if (rc)

	if (rc)

		return rc;

		return rc;

	/* Now wait for the completion. */

	/* Now wait for the completion. */

	rc = wait_event_interruptible(wq, raw3270_request_final(rq));

	rc = wait_event_interruptible(raw3270_wait_queue,

				      raw3270_request_final(rq));

	if (rc == -ERESTARTSYS) {	/* Interrupted by a signal. */

	if (rc == -ERESTARTSYS) {	/* Interrupted by a signal. */

		raw3270_halt_io(view->dev, rq);

		raw3270_halt_io(view->dev, rq);

		/* No wait for the halt to complete. */

		/* No wait for the halt to complete. */

		wait_event(wq, raw3270_request_final(rq));

		wait_event(raw3270_wait_queue, raw3270_request_final(rq));

		return -ERESTARTSYS;

		return -ERESTARTSYS;

	}

	}

	return rq->rc;

	return rq->rc;