Commit eda9f752 authored May 12, 2009 by Simon Arlott Committed by Mauro Carvalho Chehab Jun 16, 2009

V4L/DVB (11841): core: fix potential mutex_unlock without mutex_lock in dvb_dvr_read



dvb_dvr_read may unlock the dmxdev mutex and return -ENODEV, except this
function is a file op and will never be called with the mutex held.

There's existing mutex_lock and mutex_unlock around the actual read but
it's commented out.  These should probably be uncommented but the read
blocks and this could block another non-blocking reader on the mutex
instead.

This change comments out the extra mutex_unlock.

[akpm@linux-foundation.org: cleanups, simplification]
Signed-off-by: Simon Arlott <simon@fire.lp0.eu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

parent 1010ed13

drivers/media/dvb/dvb-core/dmxdev.c

+4 −10

Original line number	Diff line number	Diff line
		@@ -244,19 +244,13 @@ static ssize_t dvb_dvr_read(struct file file, char __user buf, size_t count,
		{
		struct dvb_device *dvbdev = file->private_data;
		struct dmxdev *dmxdev = dvbdev->priv;
		int ret;

		if (dmxdev->exit) {
		mutex_unlock(&dmxdev->mutex);
		if (dmxdev->exit)
		return -ENODEV;
		}

		//mutex_lock(&dmxdev->mutex);
		ret = dvb_dmxdev_buffer_read(&dmxdev->dvr_buffer,
		return dvb_dmxdev_buffer_read(&dmxdev->dvr_buffer,
		file->f_flags & O_NONBLOCK,
		buf, count, ppos);
		//mutex_unlock(&dmxdev->mutex);
		return ret;
		}

		static int dvb_dvr_set_buffer_size(struct dmxdev *dmxdev,