summaryrefslogtreecommitdiff
path: root/drivers/scsi/ch.c
diff options
context:
space:
mode:
authorHannes Reinecke <hare@suse.de>2020-02-13 18:32:06 +0300
committerMartin K. Petersen <martin.petersen@oracle.com>2020-02-24 22:54:25 +0300
commit1c7ce4bcfb9a54073d4043c00a336a064ca6e231 (patch)
tree5bdfe2a328f90da7cfd7de9a032d5b14c66f52cb /drivers/scsi/ch.c
parent66167283c21ef8ce35253397108263bdab258992 (diff)
downloadlinux-1c7ce4bcfb9a54073d4043c00a336a064ca6e231.tar.xz
scsi: ch: synchronize ch_probe() and ch_open()
The 'ch' device node is created before the configuration is being read in, which leads to a race window when ch_open() is called before that. To avoid any races we should be taking the device mutex during ch_readconfig() and ch_init_elem(), and also during ch_open(). That ensures ch_probe is finished before ch_open() completes. Link: https://lore.kernel.org/r/20200213153207.123357-3-hare@suse.de Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/ch.c')
-rw-r--r--drivers/scsi/ch.c15
1 files changed, 11 insertions, 4 deletions
diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
index e3a006d194e0..7fdb636339e4 100644
--- a/drivers/scsi/ch.c
+++ b/drivers/scsi/ch.c
@@ -606,7 +606,10 @@ ch_open(struct inode *inode, struct file *file)
mutex_unlock(&ch_mutex);
return -ENXIO;
}
+ /* Synchronize with ch_probe() */
+ mutex_lock(&ch->lock);
file->private_data = ch;
+ mutex_unlock(&ch->lock);
mutex_unlock(&ch_mutex);
return 0;
}
@@ -949,6 +952,9 @@ static int ch_probe(struct device *dev)
goto remove_idr;
}
+ mutex_init(&ch->lock);
+ kref_init(&ch->ref);
+ ch->device = sd;
class_dev = device_create(ch_sysfs_class, dev,
MKDEV(SCSI_CHANGER_MAJOR, ch->minor), ch,
"s%s", ch->name);
@@ -959,15 +965,16 @@ static int ch_probe(struct device *dev)
goto put_device;
}
- mutex_init(&ch->lock);
- kref_init(&ch->ref);
- ch->device = sd;
+ mutex_lock(&ch->lock);
ret = ch_readconfig(ch);
- if (ret)
+ if (ret) {
+ mutex_unlock(&ch->lock);
goto destroy_dev;
+ }
if (init)
ch_init_elem(ch);
+ mutex_unlock(&ch->lock);
dev_set_drvdata(dev, ch);
sdev_printk(KERN_INFO, sd, "Attached scsi changer %s\n", ch->name);