diff options
| author | Sishuai Gong <sishuai.system@gmail.com> | 2023-08-09 20:53:48 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2023-08-14 20:27:58 +0200 |
| commit | 54921a8f31d81ee13bdce9c3b488cbc34c74740d (patch) | |
| tree | cc3de2f06fa8a48eedf28d50bb7ce0236f6f22d6 /drivers/media/test-drivers | |
| parent | 607bcc4213d998d051541d8f10b5bbb7d546c0be (diff) | |
media: vivid: fix the racy dev->radio_tx_rds_owner
There is a race over dev->radio_tx_rds_owner between the two functions
mentioned below:
Thread-1 Thread-2
vivid_fop_release() vivid_radio_rx_read()
mutex_unlock(&dev->mutex)
mutex_lock_interruptible(&dev->mutex)
...
dev->radio_rx_rds_owner = file->private_data;
...
if (file->private_data == dev->radio_rx_rds_owner) {
dev->radio_tx_rds_last_block = 0;
dev->radio_tx_rds_owner = NULL;
}
This race can be fixed by only releasing the lock after vivid_fop_release()
finishes the checks.
Signed-off-by: Sishuai Gong <sishuai.system@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Diffstat (limited to 'drivers/media/test-drivers')
| -rw-r--r-- | drivers/media/test-drivers/vivid/vivid-core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/test-drivers/vivid/vivid-core.c b/drivers/media/test-drivers/vivid/vivid-core.c index c2167ccfd222..e95bdccfc18e 100644 --- a/drivers/media/test-drivers/vivid/vivid-core.c +++ b/drivers/media/test-drivers/vivid/vivid-core.c @@ -628,7 +628,6 @@ static int vivid_fop_release(struct file *file) v4l2_info(&dev->v4l2_dev, "reconnect\n"); vivid_reconnect(dev); } - mutex_unlock(&dev->mutex); if (file->private_data == dev->radio_rx_rds_owner) { dev->radio_rx_rds_last_block = 0; dev->radio_rx_rds_owner = NULL; @@ -637,6 +636,7 @@ static int vivid_fop_release(struct file *file) dev->radio_tx_rds_last_block = 0; dev->radio_tx_rds_owner = NULL; } + mutex_unlock(&dev->mutex); if (vdev->queue) return vb2_fop_release(file); return v4l2_fh_release(file); |