]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
authorTakashi Iwai <tiwai@suse.de>
Fri, 12 May 2023 15:18:00 +0000 (16:18 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 9 Jun 2023 08:22:51 +0000 (10:22 +0200)
commit72197f21d9a6c47286a57d323f6858fbed1d0f77
treec49048fcec70755efdab10a69c61e6ab3d277cbd
parentcf412b0543b77d01f74ae2303d7f8a97e6bff686
media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()

[ Upstream commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 ]

Using a semaphore in the wait_event*() condition is no good idea.
It hits a kernel WARN_ON() at prepare_to_wait_event() like:
  do not call blocking ops when !TASK_RUNNING; state=1 set at
  prepare_to_wait_event+0x6d/0x690

For avoiding the potential deadlock, rewrite to an open-coded loop
instead.  Unlike the loop in wait_event*(), this uses wait_woken()
after the condition check, hence the task state stays consistent.

CVE-2023-31084 was assigned to this bug.

Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/
Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de
Reported-by: Yu Hao <yhao016@ucr.edu>
Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/media/dvb-core/dvb_frontend.c