• Johannes Berg's avatar
    rfkill: fix rfkill_fop_read wait_event usage · 6736fde9
    Johannes Berg authored
    The code within wait_event_interruptible() is called with
    !TASK_RUNNING, so mustn't call any functions that can sleep,
    like mutex_lock().
    
    Since we re-check the list_empty() in a loop after the wait,
    it's safe to simply use list_empty() without locking.
    
    This bug has existed forever, but was only discovered now
    because all userspace implementations, including the default
    'rfkill' tool, use poll() or select() to get a readable fd
    before attempting to read.
    
    Cc: stable@vger.kernel.org
    Fixes: c64fb016 ("rfkill: create useful userspace interface")
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    6736fde9
core.c 29.4 KB