Commit 221ba151 authored by salina@us.ibm.com's avatar salina@us.ibm.com Committed by Greg Kroah-Hartman

Char: lp, protect LPGETSTATUS with port_mutex

The patch fixes a problem in the lp driver that can cause oopses as
follows:
process A:	calls lp_write, which in turn calls
		parport_ieee1284_write_compat, and that invokes
		parport_wait_peripheral
process B:	meanwhile does an ioctl(LPGETSTATUS), which call
		lp_release_parport when done. This function will set
		physport->cad = NULL.
process A:	parport_wait_peripheral tries to dereference
		physport->cad and dies

So, protect that code with the port_mutex in order to protect against
simultaneous calls to lp_read/lp_write.

Similar protection is probably required for ioctl(LPRESET)...

This patch was done by IBM a while back and we (at suse) have that
since at least 2004 in our repos. Let's make it upstream.

Signed-off-by: okir@suse.de
Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a7b594b4
...@@ -622,9 +622,12 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd, ...@@ -622,9 +622,12 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
return -EFAULT; return -EFAULT;
break; break;
case LPGETSTATUS: case LPGETSTATUS:
if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
return -EINTR;
lp_claim_parport_or_block (&lp_table[minor]); lp_claim_parport_or_block (&lp_table[minor]);
status = r_str(minor); status = r_str(minor);
lp_release_parport (&lp_table[minor]); lp_release_parport (&lp_table[minor]);
mutex_unlock(&lp_table[minor].port_mutex);
if (copy_to_user(argp, &status, sizeof(int))) if (copy_to_user(argp, &status, sizeof(int)))
return -EFAULT; return -EFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment