diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2016-02-02 12:48:09 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-02-08 08:26:57 +0300 |
| commit | 5fae054c2b5a7c10475d2e425dfea0c567c1c5dd (patch) | |
| tree | dda71124754c5cf778acd00a8bc51c1556e7b636 /drivers/platform/goldfish | |
| parent | d40a09464401265e2894061cca388fb86e05b4be (diff) | |
| download | linux-5fae054c2b5a7c10475d2e425dfea0c567c1c5dd.tar.xz | |
goldfish: locking bugs in goldfish_pipe_read_write()
We recently messed up the error handling here. We can return with the
pipe->lock held or sometimes we unlock twice by mistake.
Fixes: 2f3be88237a3 ('goldfish_pipe: Pin pages to memory while copying and other cleanups')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/platform/goldfish')
| -rw-r--r-- | drivers/platform/goldfish/goldfish_pipe.c | 22 |
1 files changed, 8 insertions, 14 deletions
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c index e3fab9a1d9f7..839df4aace76 100644 --- a/drivers/platform/goldfish/goldfish_pipe.c +++ b/drivers/platform/goldfish/goldfish_pipe.c @@ -313,7 +313,7 @@ static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer, !is_write, 0, &page, NULL); up_read(¤t->mm->mmap_sem); if (ret < 0) - return ret; + break; if (dev->version) { /* Device version 1 or newer (qemu-android) expects the @@ -400,22 +400,16 @@ static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer, while (test_bit(wakeBit, &pipe->flags)) { if (wait_event_interruptible( pipe->wake_queue, - !test_bit(wakeBit, &pipe->flags))) { - ret = -ERESTARTSYS; - break; - } - - if (test_bit(BIT_CLOSED_ON_HOST, &pipe->flags)) { - ret = -EIO; - break; - } + !test_bit(wakeBit, &pipe->flags))) + return -ERESTARTSYS; + + if (test_bit(BIT_CLOSED_ON_HOST, &pipe->flags)) + return -EIO; } /* Try to re-acquire the lock */ - if (mutex_lock_interruptible(&pipe->lock)) { - ret = -ERESTARTSYS; - break; - } + if (mutex_lock_interruptible(&pipe->lock)) + return -ERESTARTSYS; } mutex_unlock(&pipe->lock); |