Patch "media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-dvb-core-fix-kernel-warning-for-blocking-opera.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 538996e0af9d4d617dd157134f89e30188f682c8
Author: Takashi Iwai <tiwai@xxxxxxx>
Date:   Fri May 12 16:18:00 2023 +0100

    media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
    
    [ Upstream commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 ]
    
    Using a semaphore in the wait_event*() condition is no good idea.
    It hits a kernel WARN_ON() at prepare_to_wait_event() like:
      do not call blocking ops when !TASK_RUNNING; state=1 set at
      prepare_to_wait_event+0x6d/0x690
    
    For avoiding the potential deadlock, rewrite to an open-coded loop
    instead.  Unlike the loop in wait_event*(), this uses wait_woken()
    after the condition check, hence the task state stays consistent.
    
    CVE-2023-31084 was assigned to this bug.
    
    Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@xxxxxxxxxxxxxx/
    
    Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@xxxxxxx
    Reported-by: Yu Hao <yhao016@xxxxxxx>
    Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084
    Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index c41a7e5c2b928..fce0e20940780 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -293,14 +293,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe,
 	}
 
 	if (events->eventw == events->eventr) {
-		int ret;
+		struct wait_queue_entry wait;
+		int ret = 0;
 
 		if (flags & O_NONBLOCK)
 			return -EWOULDBLOCK;
 
-		ret = wait_event_interruptible(events->wait_queue,
-					       dvb_frontend_test_event(fepriv, events));
-
+		init_waitqueue_entry(&wait, current);
+		add_wait_queue(&events->wait_queue, &wait);
+		while (!dvb_frontend_test_event(fepriv, events)) {
+			wait_woken(&wait, TASK_INTERRUPTIBLE, 0);
+			if (signal_pending(current)) {
+				ret = -ERESTARTSYS;
+				break;
+			}
+		}
+		remove_wait_queue(&events->wait_queue, &wait);
 		if (ret < 0)
 			return ret;
 	}



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux