Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea5c4686 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab Committed by Greg Kroah-Hartman
Browse files

media: dvb_frontend: fix locking issues at dvb_frontend_get_event() 



commit 76d81243a487c09619822ef8e7201a756e58a87d upstream.

As warned by smatch:
	drivers/media/dvb-core/dvb_frontend.c:314 dvb_frontend_get_event() warn: inconsistent returns 'sem:&fepriv->sem'.
	  Locked on:   line 288
	               line 295
	               line 306
	               line 314
	  Unlocked on: line 303

The lock implementation for get event is wrong, as, if an
interrupt occurs, down_interruptible() will fail, and the
routine will call up() twice when userspace calls the ioctl
again.

The bad code is there since when Linux migrated to git, in
2005.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 098a4725

drivers/media/dvb-core/dvb_frontend.c

+15 −8
Original line number Diff line number Diff line
@@ -224,6 +224,18 @@ static void dvb_frontend_add_event(struct dvb_frontend *fe, fe_status_t status) 
	wake_up_interruptible (&events->wait_queue);

}



static int dvb_frontend_test_event(struct dvb_frontend_private *fepriv,

				   struct dvb_fe_events *events)

{

	int ret;



	up(&fepriv->sem);

	ret = events->eventw != events->eventr;

	down(&fepriv->sem);



	return ret;

}



static int dvb_frontend_get_event(struct dvb_frontend *fe,

			          struct dvb_frontend_event *event, int flags)

{
@@ -243,13 +255,8 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, 
		if (flags & O_NONBLOCK)

			return -EWOULDBLOCK;



		up(&fepriv->sem);



		ret = wait_event_interruptible(events->wait_queue,

						events->eventw != events->eventr);



		if (down_interruptible (&fepriv->sem))

			return -ERESTARTSYS;

					       dvb_frontend_test_event(fepriv, events));



		if (ret < 0)

			return ret;