lkml.org 
[lkml]   [2009]   [Oct]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [BUG] hidraw.c: double mutex_lock
    On Mon, 12 Oct 2009, iceberg wrote:

    > KERNEL_VERSION: 2.6.31
    > DESCRIBE:
    > In driver ./drivers/hid/hidraw.c in function hidraw_read may be
    > double mutex_lock:
    >
    > Path:
    > 1. line 50: begin first iteration of "while(ret==0)"
    > 2. line 52: first call to mutex_lock
    > 3. inner loop "while (list->head == list->tail)" does not change state
    > of mutex, because mutex_lock immediatelly follows mutex_unlock
    > 4. if we go to the second iteration of "while(ret == 0)" in
    > line 50 then there are second call to mutex_lock in line 52 (mutex
    > aquired twice).
    >
    > Second iteration of loop "while(ret==0)" is possible if local variable
    > ret is not changed at line 94: ret+=len - i.e. len==0;
    > Variable len may be zero if hidraw_read is called with count==0 or
    > list->buffer[list->tail].len == 0.

    Good catch. I will fix that up by moving the mutex_lock() so that it's
    locked before the loop is entered.

    Thanks,

    --
    Jiri Kosina
    SUSE Labs, Novell Inc.


    \
     
     \ /
      Last update: 2009-10-12 11:35    [W:0.023 / U:0.512 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site