Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756594AbbKRR57 (ORCPT ); Wed, 18 Nov 2015 12:57:59 -0500 Received: from smtp113.iad3a.emailsrvr.com ([173.203.187.113]:55791 "EHLO smtp113.iad3a.emailsrvr.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932732AbbKRRzY (ORCPT ); Wed, 18 Nov 2015 12:55:24 -0500 X-Auth-ID: abbotti@mev.co.uk X-Sender-Id: abbotti@mev.co.uk From: Ian Abbott To: driverdev-devel@linuxdriverproject.org Cc: Greg Kroah-Hartman , Ian Abbott , H Hartley Sweeten , linux-kernel@vger.kernel.org Subject: [PATCH 2/8] staging: comedi: do extra checks for becoming non-busy for "write" Date: Wed, 18 Nov 2015 17:55:05 +0000 Message-Id: <1447869311-21955-3-git-send-email-abbotti@mev.co.uk> X-Mailer: git-send-email 2.6.2 In-Reply-To: <1447869311-21955-1-git-send-email-abbotti@mev.co.uk> References: <1447869311-21955-1-git-send-email-abbotti@mev.co.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2440 Lines: 53 `comedi_write()` is the handler for the "write" file operation for COMEDI devices. It mostly runs without using the main mutex of the COMEDI device, but uses the `attach_lock` rw_semaphore to protect against the COMEDI device becoming "detached". A file object can write data for a COMEDI asynchonous command if it initiated the command. The COMEDI subdevice is marked as busy when the command is started. At some point, the "write" handler detects that the command has terminated and so marks the subdevice as non-busy. In order to mark the subdevice as non-busy, the "write" handler needs to release the `attach_lock` rw_semaphore and `acquire the main `mutex`. There is a vulnerable point between the two, so it checks that the device is still attached after acquiring the mutex. However, it does not currently check that the conditions for becoming non-busy still hold. Add some more checks that the subdevice is still busy with a command initiated by the same file object, and that the command is in the correct direction (in case the subdevice supports both "read" and "write"). Signed-off-by: Ian Abbott --- drivers/staging/comedi/comedi_fops.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index c9da6f3..94c2348 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -2420,10 +2420,15 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, * sufficient (unless there have been 2**32 detaches in the * meantime!), but check the subdevice pointer as well just in * case. + * + * Also check the subdevice is still in a suitable state to + * become non-busy in case it changed behind our back. */ new_s = comedi_file_write_subdevice(file); if (dev->attached && old_detach_count == dev->detach_count && - s == new_s && new_s->async == async) + s == new_s && new_s->async == async && s->busy == file && + (async->cmd.flags & CMDF_WRITE) && + !comedi_is_subdevice_running(s)) do_become_nonbusy(dev, s); mutex_unlock(&dev->mutex); } -- 2.6.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/