Char: lp, protect LPGETSTATUS with port_mutex
authorsalina@us.ibm.com <salina@us.ibm.com>
Tue, 7 May 2013 14:18:09 +0000 (16:18 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 May 2013 01:08:58 +0000 (18:08 -0700)
The patch fixes a problem in the lp driver that can cause oopses as
follows:
process A: calls lp_write, which in turn calls
parport_ieee1284_write_compat, and that invokes
parport_wait_peripheral
process B: meanwhile does an ioctl(LPGETSTATUS), which call
lp_release_parport when done. This function will set
physport->cad = NULL.
process A: parport_wait_peripheral tries to dereference
physport->cad and dies

So, protect that code with the port_mutex in order to protect against
simultaneous calls to lp_read/lp_write.

Similar protection is probably required for ioctl(LPRESET)...

This patch was done by IBM a while back and we (at suse) have that
since at least 2004 in our repos. Let's make it upstream.

Signed-off-by: okir@suse.de
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/char/lp.c

index dafd9ac6428f2de6e4c2120c675337307d8bd9d6..0913d79424d3a3e81930a4c138979a621de18605 100644 (file)
@@ -622,9 +622,12 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
                                return -EFAULT;
                        break;
                case LPGETSTATUS:
+                       if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
+                               return -EINTR;
                        lp_claim_parport_or_block (&lp_table[minor]);
                        status = r_str(minor);
                        lp_release_parport (&lp_table[minor]);
+                       mutex_unlock(&lp_table[minor].port_mutex);
 
                        if (copy_to_user(argp, &status, sizeof(int)))
                                return -EFAULT;