Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3a2d3d21 authored by Oleksandr Kozaruk's avatar Oleksandr Kozaruk Committed by Greg Kroah-Hartman
Browse files

drivers: misc: ti-st: fix potential race if st_kim_start fails 



If st_kim_start() fails registered protocols should be removed. This is
done by calling st_reg_complete(), which as comment states is called
with spin lock held. But in st_register() when st_kim_start fails it
is called without holding spin lock, creating possibility of concurrent
access to st_gdata data members.
Hold spin lock while calling st_reg_complete if st_kim_start() fails.

Signed-off-by: default avatarOleksandr Kozaruk <oleksandr.kozaruk@globallogic.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 666b9adc

drivers/misc/ti-st/st_core.c

+2 −0
Original line number Diff line number Diff line
@@ -562,7 +562,9 @@ long st_register(struct st_proto_s *new_proto) 
			if ((st_gdata->protos_registered != ST_EMPTY) &&

			    (test_bit(ST_REG_PENDING, &st_gdata->st_state))) {

				pr_err(" KIM failure complete callback ");

				spin_lock_irqsave(&st_gdata->lock, flags);

				st_reg_complete(st_gdata, err);

				spin_unlock_irqrestore(&st_gdata->lock, flags);

				clear_bit(ST_REG_PENDING, &st_gdata->st_state);

			}

			return -EINVAL;