[PATCH 01/15] Char: lp, protect LPGETSTATUS with port_mutex

[Jiri Slaby]

From: "salina@xxxxxxxxxx" <salina@xxxxxxxxxx>

The patch fixes a problem in the lp driver that can cause oopses as
follows:
process A:	calls lp_write, which in turn calls
		parport_ieee1284_write_compat, and that invokes
		parport_wait_peripheral
process B:	meanwhile does an ioctl(LPGETSTATUS), which call
		lp_release_parport when done. This function will set
		physport->cad = NULL.
process A:	parport_wait_peripheral tries to dereference
		physport->cad and dies

So, protect that code with the port_mutex in order to protect against
simultaneous calls to lp_read/lp_write.

Similar protection is probably required for ioctl(LPRESET)...

This patch was done by IBM a while back and we (at suse) have that
since at least 2004 in our repos. Let's make it upstream.

Signed-off-by: okir@xxxxxxx
Signed-off-by: Jiri Slaby <jslaby@xxxxxxx>
Cc: Arnd Bergmann <arnd@xxxxxxxx>
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/char/lp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index dafd9ac..0913d79 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -622,9 +622,12 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
 				return -EFAULT;
 			break;
 		case LPGETSTATUS:
+			if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
+				return -EINTR;
 			lp_claim_parport_or_block (&lp_table[minor]);
 			status = r_str(minor);
 			lp_release_parport (&lp_table[minor]);
+			mutex_unlock(&lp_table[minor].port_mutex);
 
 			if (copy_to_user(argp, &status, sizeof(int)))
 				return -EFAULT;
-- 
1.8.2.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/