Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a464189d authored by Elias Oltmanns's avatar Elias Oltmanns Committed by Jeff Garzik
Browse files

libata: Fix a potential race condition in ata_scsi_park_show() 



Peter Moulder has pointed out that there is a slight chance that a
negative value might be passed to jiffies_to_msecs() in
ata_scsi_park_show(). This is fixed by saving the value of jiffies in a
local variable, thus also reducing code since the volatile variable
jiffies is accessed only once.

Signed-off-by: default avatarElias Oltmanns <eo@nebensachen.de>
Signed-off-by: Tejun Heo <tj.kernel.org>
Signed-off-by: default avatarJeff Garzik <jgarzik@redhat.com>
parent 3c324283

drivers/ata/libata-scsi.c

+4 −3
Original line number Diff line number Diff line
@@ -190,7 +190,7 @@ static ssize_t ata_scsi_park_show(struct device *device, 
	struct ata_port *ap;

	struct ata_link *link;

	struct ata_device *dev;

	unsigned long flags;

	unsigned long flags, now;

	unsigned int uninitialized_var(msecs);

	int rc = 0;
@@ -208,10 +208,11 @@ static ssize_t ata_scsi_park_show(struct device *device, 
	}



	link = dev->link;

	now = jiffies;

	if (ap->pflags & ATA_PFLAG_EH_IN_PROGRESS &&

	    link->eh_context.unloaded_mask & (1 << dev->devno) &&

	    time_after(dev->unpark_deadline, jiffies))

		msecs = jiffies_to_msecs(dev->unpark_deadline - jiffies);

	    time_after(dev->unpark_deadline, now))

		msecs = jiffies_to_msecs(dev->unpark_deadline - now);

	else

		msecs = 0;