From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: David Frey <dpfrey@gmail.com>,
Andreas Dannenberg <dannenberg@ti.com>,
Stable@vger.kernel.org,
Jonathan Cameron <Jonathan.Cameron@huawei.com>,
Sasha Levin <sashal@kernel.org>,
linux-iio@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 092/100] iio: light: opt3001: fix mutex unlock race
Date: Fri, 18 Oct 2019 18:05:17 -0400 [thread overview]
Message-ID: <20191018220525.9042-92-sashal@kernel.org> (raw)
In-Reply-To: <20191018220525.9042-1-sashal@kernel.org>
From: David Frey <dpfrey@gmail.com>
[ Upstream commit 82f3015635249a8c8c45bac303fd84905066f04f ]
When an end-of-conversion interrupt is received after performing a
single-shot reading of the light sensor, the driver was waking up the
result ready queue before checking opt->ok_to_ignore_lock to determine
if it should unlock the mutex. The problem occurred in the case where
the other thread woke up and changed the value of opt->ok_to_ignore_lock
to false prior to the interrupt thread performing its read of the
variable. In this case, the mutex would be unlocked twice.
Signed-off-by: David Frey <dpfrey@gmail.com>
Reviewed-by: Andreas Dannenberg <dannenberg@ti.com>
Fixes: 94a9b7b1809f ("iio: light: add support for TI's opt3001 light sensor")
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/opt3001.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c
index 54d88b60e3035..f9d13e4ec1083 100644
--- a/drivers/iio/light/opt3001.c
+++ b/drivers/iio/light/opt3001.c
@@ -694,6 +694,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
struct iio_dev *iio = _iio;
struct opt3001 *opt = iio_priv(iio);
int ret;
+ bool wake_result_ready_queue = false;
if (!opt->ok_to_ignore_lock)
mutex_lock(&opt->lock);
@@ -728,13 +729,16 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
}
opt->result = ret;
opt->result_ready = true;
- wake_up(&opt->result_ready_queue);
+ wake_result_ready_queue = true;
}
out:
if (!opt->ok_to_ignore_lock)
mutex_unlock(&opt->lock);
+ if (wake_result_ready_queue)
+ wake_up(&opt->result_ready_queue);
+
return IRQ_HANDLED;
}
--
2.20.1
prev parent reply other threads:[~2019-10-18 22:17 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20191018220525.9042-1-sashal@kernel.org>
2019-10-18 22:04 ` [PATCH AUTOSEL 4.19 050/100] iio: adc: meson_saradc: Fix memory allocation order Sasha Levin
2019-10-18 22:04 ` [PATCH AUTOSEL 4.19 051/100] iio: fix center temperature of bmc150-accel-core Sasha Levin
2019-10-18 22:05 ` [PATCH AUTOSEL 4.19 089/100] iio: adc: hx711: fix bug in sampling of data Sasha Levin
2019-10-18 22:05 ` [PATCH AUTOSEL 4.19 090/100] iio: imu: adis16400: release allocated memory on failure Sasha Levin
2019-10-18 22:05 ` [PATCH AUTOSEL 4.19 091/100] iio: adc: ad799x: fix probe error handling Sasha Levin
2019-10-18 22:05 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191018220525.9042-92-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=Jonathan.Cameron@huawei.com \
--cc=dannenberg@ti.com \
--cc=dpfrey@gmail.com \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).