media: vivid: fix the racy dev->radio_tx_rds_owner
authorSishuai Gong <sishuai.system@gmail.com>
Thu, 10 Aug 2023 00:53:48 +0000 (20:53 -0400)
committerMauro Carvalho Chehab <mchehab@kernel.org>
Mon, 14 Aug 2023 18:27:58 +0000 (20:27 +0200)
commit54921a8f31d81ee13bdce9c3b488cbc34c74740d
treecc3de2f06fa8a48eedf28d50bb7ce0236f6f22d6
parent607bcc4213d998d051541d8f10b5bbb7d546c0be
media: vivid: fix the racy dev->radio_tx_rds_owner

There is a race over dev->radio_tx_rds_owner between the two functions
mentioned below:

Thread-1                Thread-2
vivid_fop_release()     vivid_radio_rx_read()
mutex_unlock(&dev->mutex)
                        mutex_lock_interruptible(&dev->mutex)
                        ...
                        dev->radio_rx_rds_owner = file->private_data;
...
if (file->private_data == dev->radio_rx_rds_owner) {
        dev->radio_tx_rds_last_block = 0;
        dev->radio_tx_rds_owner = NULL;
}

This race can be fixed by only releasing the lock after vivid_fop_release()
finishes the checks.

Signed-off-by: Sishuai Gong <sishuai.system@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
drivers/media/test-drivers/vivid/vivid-core.c