[PATCH 2/8] staging: comedi: do extra checks for becoming non-busy for "write"

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



`comedi_write()` is the handler for the "write" file operation for
COMEDI devices.  It mostly runs without using the main mutex of the
COMEDI device, but uses the `attach_lock` rw_semaphore to protect
against the COMEDI device becoming "detached".  A file object can write
data for a COMEDI asynchonous command if it initiated the command.  The
COMEDI subdevice is marked as busy when the command is started.  At some
point, the "write" handler detects that the command has terminated and
so marks the subdevice as non-busy.

In order to mark the subdevice as non-busy, the "write" handler needs to
release the `attach_lock` rw_semaphore and `acquire the main `mutex`.
There is a vulnerable point between the two, so it checks that the
device is still attached after acquiring the mutex.  However, it does
not currently check that the conditions for becoming non-busy still
hold.  Add some more checks that the subdevice is still busy with a
command initiated by the same file object, and that the command is in
the correct direction (in case the subdevice supports both "read" and
"write").

Signed-off-by: Ian Abbott <abbotti@xxxxxxxxx>
---
 drivers/staging/comedi/comedi_fops.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index c9da6f3..94c2348 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -2420,10 +2420,15 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
 		 * sufficient (unless there have been 2**32 detaches in the
 		 * meantime!), but check the subdevice pointer as well just in
 		 * case.
+		 *
+		 * Also check the subdevice is still in a suitable state to
+		 * become non-busy in case it changed behind our back.
 		 */
 		new_s = comedi_file_write_subdevice(file);
 		if (dev->attached && old_detach_count == dev->detach_count &&
-		    s == new_s && new_s->async == async)
+		    s == new_s && new_s->async == async && s->busy == file &&
+		    (async->cmd.flags & CMDF_WRITE) &&
+		    !comedi_is_subdevice_running(s))
 			do_become_nonbusy(dev, s);
 		mutex_unlock(&dev->mutex);
 	}
-- 
2.6.2

_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel



[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux