• Jiri Kosina's avatar
    floppy: fix lock_fdc() signal handling · a0c80efe
    Jiri Kosina authored
    floppy_revalidate() doesn't perform any error handling on lock_fdc()
    result. lock_fdc() might actually be interrupted by a signal (it waits for
    fdc becoming non-busy interruptibly). In such case, floppy_revalidate()
    proceeds as if it had claimed the lock, but it fact it doesn't.
    
    In case of multiple threads trying to open("/dev/fdX"), this leads to
    serious corruptions all over the place, because all of a sudden there is
    no critical section protection (that'd otherwise be guaranteed by locked
    fd) whatsoever.
    
    While at this, fix the fact that the 'interruptible' parameter to
    lock_fdc() doesn't make any sense whatsoever, because we always wait
    interruptibly anyway.
    
    Most of the lock_fdc() callsites do properly handle error (and propagate
    EINTR), but floppy_revalidate() and floppy_check_events() don't. Fix this.
    
    Spotted by 'syzkaller' tool.
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Tested-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
    a0c80efe
floppy.c 118 KB