media: cec: cec-api: add locking in cec_release()

Hans Verkuil · mchehab · commit 42bcaacae924 · 2024-05-02T18:59:09.000+01:00
When cec_release() uses fh->msgs it has to take fh->lock, otherwise the list can get corrupted. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reported-by: Yang, Chenyuan <cy54@illinois.edu> Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/ Fixes: ca68438 ("[media] cec: add HDMI CEC framework (api)") Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c
@@ -664,6 +664,8 @@ static int cec_release(struct inode *inode, struct file *filp)
 		list_del_init(&data->xfer_list);
 	}
 	mutex_unlock(&adap->lock);
+
+	mutex_lock(&fh->lock);
 	while (!list_empty(&fh->msgs)) {
 		struct cec_msg_entry *entry =
 			list_first_entry(&fh->msgs, struct cec_msg_entry, list);
@@ -681,6 +683,7 @@ static int cec_release(struct inode *inode, struct file *filp)
 			kfree(entry);
 		}
 	}
+	mutex_unlock(&fh->lock);
 	kfree(fh);
 
 	cec_put_device(devnode);

Original file line number	Diff line number	Diff line change
`@@ -664,6 +664,8 @@ static int cec_release(struct inode inode, struct file filp)`
`664`	`664`	`list_del_init(&data->xfer_list);`
`665`	`665`	`}`
`666`	`666`	`mutex_unlock(&adap->lock);`
	`667`	`+`
	`668`	`+ mutex_lock(&fh->lock);`
`667`	`669`	`while (!list_empty(&fh->msgs)) {`
`668`	`670`	`struct cec_msg_entry *entry =`
`669`	`671`	`list_first_entry(&fh->msgs, struct cec_msg_entry, list);`
`@@ -681,6 +683,7 @@ static int cec_release(struct inode inode, struct file filp)`
`681`	`683`	`kfree(entry);`
`682`	`684`	`}`
`683`	`685`	`}`
	`686`	`+ mutex_unlock(&fh->lock);`
`684`	`687`	`kfree(fh);`
`685`	`688`
`686`	`689`	`cec_put_device(devnode);`