diff options
author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2014-02-10 17:25:35 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-02-10 19:01:40 -0500 |
commit | a3eb7fbb41eb8d6e22d491741b8c5d5aa6cb069a (patch) | |
tree | e82b1ed3c523ba903a104ad4e6f6f09fd76dd314 | |
parent | 3cf8ca1c250d3c3d8bf61f20bd71acd1876bf777 (diff) |
drivers/message/i2o/i2o_config.c: fix deadlock in compat_ioctl(I2OGETIOPS)
i2o_cfg_compat_ioctl(I2OGETIOPS) locks i2o_cfg_mutex and then calls
i2o_cfg_ioctl(I2OGETIOPS) that locks i2o_cfg_mutex as well. A deadlock
is guaranteed.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | drivers/message/i2o/i2o_config.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c index a60c188c2bd9..04bd3b6de401 100644 --- a/drivers/message/i2o/i2o_config.c +++ b/drivers/message/i2o/i2o_config.c | |||
@@ -754,19 +754,19 @@ static long i2o_cfg_compat_ioctl(struct file *file, unsigned cmd, | |||
754 | unsigned long arg) | 754 | unsigned long arg) |
755 | { | 755 | { |
756 | int ret; | 756 | int ret; |
757 | mutex_lock(&i2o_cfg_mutex); | ||
758 | switch (cmd) { | 757 | switch (cmd) { |
759 | case I2OGETIOPS: | 758 | case I2OGETIOPS: |
760 | ret = i2o_cfg_ioctl(file, cmd, arg); | 759 | ret = i2o_cfg_ioctl(file, cmd, arg); |
761 | break; | 760 | break; |
762 | case I2OPASSTHRU32: | 761 | case I2OPASSTHRU32: |
762 | mutex_lock(&i2o_cfg_mutex); | ||
763 | ret = i2o_cfg_passthru32(file, cmd, arg); | 763 | ret = i2o_cfg_passthru32(file, cmd, arg); |
764 | mutex_unlock(&i2o_cfg_mutex); | ||
764 | break; | 765 | break; |
765 | default: | 766 | default: |
766 | ret = -ENOIOCTLCMD; | 767 | ret = -ENOIOCTLCMD; |
767 | break; | 768 | break; |
768 | } | 769 | } |
769 | mutex_unlock(&i2o_cfg_mutex); | ||
770 | return ret; | 770 | return ret; |
771 | } | 771 | } |
772 | 772 | ||