Commit 963761a0 authored by Sean Young's avatar Sean Young Committed by Mauro Carvalho Chehab

[media] rc-core: race condition during ir_raw_event_register()

A rc device can call ir_raw_event_handle() after rc_allocate_device(),
but before rc_register_device() has completed. This is racey because
rcdev->raw is set before rcdev->raw->thread has a valid value.

Cc: stable@kernel.org
Reported-by: default avatarkbuild test robot <fengguang.wu@intel.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 20249f84
...@@ -211,7 +211,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_set_idle); ...@@ -211,7 +211,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_set_idle);
*/ */
void ir_raw_event_handle(struct rc_dev *dev) void ir_raw_event_handle(struct rc_dev *dev)
{ {
if (!dev->raw) if (!dev->raw || !dev->raw->thread)
return; return;
wake_up_process(dev->raw->thread); wake_up_process(dev->raw->thread);
...@@ -490,6 +490,7 @@ int ir_raw_event_register(struct rc_dev *dev) ...@@ -490,6 +490,7 @@ int ir_raw_event_register(struct rc_dev *dev)
{ {
int rc; int rc;
struct ir_raw_handler *handler; struct ir_raw_handler *handler;
struct task_struct *thread;
if (!dev) if (!dev)
return -EINVAL; return -EINVAL;
...@@ -507,13 +508,15 @@ int ir_raw_event_register(struct rc_dev *dev) ...@@ -507,13 +508,15 @@ int ir_raw_event_register(struct rc_dev *dev)
* because the event is coming from userspace * because the event is coming from userspace
*/ */
if (dev->driver_type != RC_DRIVER_IR_RAW_TX) { if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
dev->raw->thread = kthread_run(ir_raw_event_thread, dev->raw, thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%u",
"rc%u", dev->minor); dev->minor);
if (IS_ERR(dev->raw->thread)) { if (IS_ERR(thread)) {
rc = PTR_ERR(dev->raw->thread); rc = PTR_ERR(thread);
goto out; goto out;
} }
dev->raw->thread = thread;
} }
mutex_lock(&ir_raw_handler_lock); mutex_lock(&ir_raw_handler_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment