summaryrefslogtreecommitdiff
path: root/drivers/staging
diff options
context:
space:
mode:
authorHugo Lefeuvre <hle@owl.eu.com>2018-06-20 09:37:19 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-06-28 22:00:13 +0900
commit983000d7fa5d7538915810b58c9e63cb6118eb1e (patch)
tree79bde4ed7e0f77abc710dad35b2664ce1216ea24 /drivers/staging
parent10c553b154c725e27da2f09e45692222f97beb6e (diff)
staging: pi433: fix race condition in pi433_open
The device structure contains a useless non-atomic users counter which is subject to race conditions. It has probably been created to handle the case where remove is executed while operations are still executing on open fds but this will never happen because of reference counts. Drop the users counter and move rx buffer {de,}allocation to probe() and remove(). Remove associated dead code from open() and release(). Remove related TODO entry from ioctl(). Signed-off-by: Hugo Lefeuvre <hle@owl.eu.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
-rw-r--r--drivers/staging/pi433/pi433_if.c41
1 files changed, 12 insertions, 29 deletions
diff --git a/drivers/staging/pi433/pi433_if.c b/drivers/staging/pi433/pi433_if.c
index 94e0bfcec991..0638fd5f14d9 100644
--- a/drivers/staging/pi433/pi433_if.c
+++ b/drivers/staging/pi433/pi433_if.c
@@ -78,7 +78,6 @@ struct pi433_device {
struct device *dev;
struct cdev *cdev;
struct spi_device *spi;
- unsigned int users;
/* irq related values */
struct gpio_desc *gpiod[NUM_DIO];
@@ -887,9 +886,6 @@ pi433_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
if (_IOC_TYPE(cmd) != PI433_IOC_MAGIC)
return -ENOTTY;
- /* TODO? guard against device removal before, or while,
- * we issue this ioctl. --> device_get()
- */
instance = filp->private_data;
device = instance->device;
@@ -963,19 +959,9 @@ static int pi433_open(struct inode *inode, struct file *filp)
return -ENODEV;
}
- if (!device->rx_buffer) {
- device->rx_buffer = kmalloc(MAX_MSG_SIZE, GFP_KERNEL);
- if (!device->rx_buffer)
- return -ENOMEM;
- }
-
- device->users++;
instance = kzalloc(sizeof(*instance), GFP_KERNEL);
- if (!instance) {
- kfree(device->rx_buffer);
- device->rx_buffer = NULL;
+ if (!instance)
return -ENOMEM;
- }
/* setup instance data*/
instance->device = device;
@@ -992,23 +978,11 @@ static int pi433_open(struct inode *inode, struct file *filp)
static int pi433_release(struct inode *inode, struct file *filp)
{
struct pi433_instance *instance;
- struct pi433_device *device;
instance = filp->private_data;
- device = instance->device;
kfree(instance);
filp->private_data = NULL;
- /* last close? */
- device->users--;
-
- if (!device->users) {
- kfree(device->rx_buffer);
- device->rx_buffer = NULL;
- if (!device->spi)
- kfree(device);
- }
-
return 0;
}
@@ -1178,6 +1152,13 @@ static int pi433_probe(struct spi_device *spi)
device->tx_active = false;
device->interrupt_rx_allowed = false;
+ /* init rx buffer */
+ device->rx_buffer = kmalloc(MAX_MSG_SIZE, GFP_KERNEL);
+ if (!device->rx_buffer) {
+ retval = -ENOMEM;
+ goto RX_failed;
+ }
+
/* init wait queues */
init_waitqueue_head(&device->tx_wait_queue);
init_waitqueue_head(&device->rx_wait_queue);
@@ -1280,6 +1261,8 @@ device_create_failed:
minor_failed:
free_gpio(device);
GPIO_failed:
+ kfree(device->rx_buffer);
+RX_failed:
kfree(device);
return retval;
@@ -1303,8 +1286,8 @@ static int pi433_remove(struct spi_device *spi)
pi433_free_minor(device);
- if (device->users == 0)
- kfree(device);
+ kfree(device->rx_buffer);
+ kfree(device);
return 0;
}