lkml.org 
[lkml]   [2009]   [Jan]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] fbmem: copy_from/to_user() with mutex held (v2)
From
On Mon, Jan 19, 2009 at 9:54 PM, Krzysztof Helt <krzysztof.h1@wp.pl> wrote:
> On Mon, 19 Jan 2009 12:04:04 +0100
> Andrea Righi <righi.andrea@gmail.com> wrote:
>
>> Avoid to call copy_from/to_user() with fb_info->lock mutex held in fbmem
>> ioctl().
>>
>> fb_mmap() is called under mm->mmap_sem (A) held, that also acquires
>> fb_info->lock (B); fb_ioctl() takes fb_info->lock (B) and does
>> copy_from/to_user() that might acquire mm->mmap_sem (A), causing a
>> deadlock.
>>
>> NOTE: it doesn't push down the fb_info->lock in each own driver's
>> fb_ioctl(), so there're still potential deadlocks somewhere.
>>
>
>> diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
>> index 756efeb..fe6033e 100644
>> --- a/drivers/video/fbmem.c
>> +++ b/drivers/video/fbmem.c
>> @@ -1013,25 +1013,26 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
> (...)
>> case FBIOPUT_VSCREENINFO:
>> - if (copy_from_user(&var, argp, sizeof(var))) {
>> - ret = -EFAULT;
>> - break;
>> - }
>> + if (copy_from_user(&var, argp, sizeof(var)))
>> + return -EFAULT;
>> + if (!lock_fb_info(info))
>> + return -ENODEV;
>> acquire_console_sem();
>> info->flags |= FBINFO_MISC_USEREVENT;
>> ret = fb_set_var(info, &var);
>> @@ -1041,104 +1042,109 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
>> ret = -EFAULT;
>> break;
>
> I don't see a call to unlock_fb_info(info) in the case for FBIOPUT_VSCREENINFO.
> Is it intentional?

No, it's a bug :(. I'll post a new patch soon.

Thanks for reviewing!
-Andrea

>
> Kind regards,
> Krzysztof


\
 
 \ /
  Last update: 2009-01-20 09:25    [W:0.375 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site