lkml.org 
[lkml]   [2013]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 01/15] Char: lp, protect LPGETSTATUS with port_mutex
    Date
    From: "salina@us.ibm.com" <salina@us.ibm.com>

    The patch fixes a problem in the lp driver that can cause oopses as
    follows:
    process A: calls lp_write, which in turn calls
    parport_ieee1284_write_compat, and that invokes
    parport_wait_peripheral
    process B: meanwhile does an ioctl(LPGETSTATUS), which call
    lp_release_parport when done. This function will set
    physport->cad = NULL.
    process A: parport_wait_peripheral tries to dereference
    physport->cad and dies

    So, protect that code with the port_mutex in order to protect against
    simultaneous calls to lp_read/lp_write.

    Similar protection is probably required for ioctl(LPRESET)...

    This patch was done by IBM a while back and we (at suse) have that
    since at least 2004 in our repos. Let's make it upstream.

    Signed-off-by: okir@suse.de
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/char/lp.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/char/lp.c b/drivers/char/lp.c
    index dafd9ac..0913d79 100644
    --- a/drivers/char/lp.c
    +++ b/drivers/char/lp.c
    @@ -622,9 +622,12 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
    return -EFAULT;
    break;
    case LPGETSTATUS:
    + if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
    + return -EINTR;
    lp_claim_parport_or_block (&lp_table[minor]);
    status = r_str(minor);
    lp_release_parport (&lp_table[minor]);
    + mutex_unlock(&lp_table[minor].port_mutex);

    if (copy_to_user(argp, &status, sizeof(int)))
    return -EFAULT;
    --
    1.8.2.1


    \
     
     \ /
      Last update: 2013-05-07 17:21    [W:3.588 / U:0.340 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site