summaryrefslogtreecommitdiff
path: root/drivers/tty/tty_ldsem.c
diff options
context:
space:
mode:
authorDmitry Safonov <dima@arista.com>2018-11-01 00:24:52 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-12-05 12:16:33 +0100
commit2f588cee24caf01c1ac08fff90d67c6af555e7c7 (patch)
tree6bac641d07aa56fadcd1a7b624ddbec8064fe19b /drivers/tty/tty_ldsem.c
parent110b89282f658593a5a4a96a300d5aa51f1bf88f (diff)
tty/ldsem: Decrement wait_readers on timeouted down_read()
It seems like when ldsem_down_read() fails with timeout, it misses update for sem->wait_readers. By that reason, when writer finally releases write end of the semaphore __ldsem_wake_readers() does adjust sem->count with wrong value: sem->wait_readers * (LDSEM_ACTIVE_BIAS - LDSEM_WAIT_BIAS) I.e, if update comes with 1 missed wait_readers decrement, sem->count will be 0x100000001 which means that there is active reader and it'll make any further writer to fail in acquiring the semaphore. It looks like, this is a dead-code, because ldsem_down_read() is never called with timeout different than MAX_SCHEDULE_TIMEOUT, so it might be worth to delete timeout parameter and error path fall-back.. Cc: Jiri Slaby <jslaby@suse.com> Signed-off-by: Dmitry Safonov <dima@arista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty/tty_ldsem.c')
-rw-r--r--drivers/tty/tty_ldsem.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
index d4d0dbf4a6d9..717292c1c0df 100644
--- a/drivers/tty/tty_ldsem.c
+++ b/drivers/tty/tty_ldsem.c
@@ -212,6 +212,7 @@ down_read_failed(struct ld_semaphore *sem, long count, long timeout)
raw_spin_lock_irq(&sem->wait_lock);
if (waiter.task) {
atomic_long_add_return(-LDSEM_WAIT_BIAS, &sem->count);
+ sem->wait_readers--;
list_del(&waiter.list);
raw_spin_unlock_irq(&sem->wait_lock);
put_task_struct(waiter.task);