diff options
| author | Ian Munsie <imunsie@au1.ibm.com> | 2014-10-09 11:17:46 +1100 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2014-10-09 11:29:57 +1100 |
| commit | d53ba6b3bba33432cc37b7101a86f8f3392c46e7 (patch) | |
| tree | a82fe60070c230303bc1daa7ce55384ab46904d0 | |
| parent | a9282d01cf357379ce29103cec5e7651a53c634d (diff) | |
| download | linux-stable-d53ba6b3bba33432cc37b7101a86f8f3392c46e7.tar.gz linux-stable-d53ba6b3bba33432cc37b7101a86f8f3392c46e7.tar.bz2 linux-stable-d53ba6b3bba33432cc37b7101a86f8f3392c46e7.zip | |
cxl: Fix afu_read() not doing finish_wait() on signal or non-blocking
If afu_read() returned due to a signal or the AFU file descriptor being
opened non-blocking it would not call finish_wait() before returning,
which could lead to a crash later when something else wakes up the wait
queue.
This patch restructures the wait logic to ensure that the cleanup is
done correctly.
Signed-off-by: Ian Munsie <imunsie@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
| -rw-r--r-- | drivers/misc/cxl/file.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c index 847b7e646a7e..378b099e7c0b 100644 --- a/drivers/misc/cxl/file.c +++ b/drivers/misc/cxl/file.c @@ -273,6 +273,7 @@ static ssize_t afu_read(struct file *file, char __user *buf, size_t count, struct cxl_context *ctx = file->private_data; struct cxl_event event; unsigned long flags; + int rc; DEFINE_WAIT(wait); if (count < CXL_READ_MIN_SIZE) @@ -285,13 +286,17 @@ static ssize_t afu_read(struct file *file, char __user *buf, size_t count, if (ctx_event_pending(ctx)) break; - spin_unlock_irqrestore(&ctx->lock, flags); - if (file->f_flags & O_NONBLOCK) - return -EAGAIN; + if (file->f_flags & O_NONBLOCK) { + rc = -EAGAIN; + goto out; + } - if (signal_pending(current)) - return -ERESTARTSYS; + if (signal_pending(current)) { + rc = -ERESTARTSYS; + goto out; + } + spin_unlock_irqrestore(&ctx->lock, flags); pr_devel("afu_read going to sleep...\n"); schedule(); pr_devel("afu_read woken up\n"); @@ -336,6 +341,11 @@ static ssize_t afu_read(struct file *file, char __user *buf, size_t count, if (copy_to_user(buf, &event, event.header.size)) return -EFAULT; return event.header.size; + +out: + finish_wait(&ctx->wq, &wait); + spin_unlock_irqrestore(&ctx->lock, flags); + return rc; } static const struct file_operations afu_fops = { |