pps: fix race in PPS_FETCH handler

There was a race in PPS_FETCH ioctl handler when several processes want to
obtain PPS data simultaneously using sleeping PPS_FETCH.  They all sleep
most of the time in the system call.

With the old approach when the first process waiting on the pps queue is
waken up it makes new system call right away and zeroes pps->go.  So other
processes continue to sleep.  This is a clear race condition because of
the global 'go' variable.

With the new approach pps->last_ev holds some value increasing at each PPS
event.  PPS_FETCH ioctl handler saves current value to the local variable
at the very beginning so it can safely check that there is a new event by
just comparing both variables.

Signed-off-by: Alexander Gordeev <lasaine@lvk.cs.msu.su>
Acked-by: Rodolfo Giometti <giometti@linux.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index 55f39618261b1db88ef98cb8aec03b15d868be21..3f89f5eba81c80b0b9d96cd37745c75be993fc29 100644 (file)
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -326,8 +326,8 @@ void pps_event(int source, struct pps_ktime *ts, int event, void *data)
 
        /* Wake up if captured something */
        if (captured) {
-               pps->go = ~0;
-               wake_up_interruptible(&pps->queue);
+               pps->last_ev++;
+               wake_up_interruptible_all(&pps->queue);
 
                kill_fasync(&pps->async_queue, SIGIO, POLL_IN);
        }

diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index c76afb980a988985c939800e5d7ee0753002809b..dc7e66cb2762b0552d0eecd7015f2a5ed3a79391 100644 (file)
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -136,6 +136,7 @@ static long pps_cdev_ioctl(struct file *file,
 
        case PPS_FETCH: {
                struct pps_fdata fdata;
+               unsigned int ev;
 
                pr_debug("PPS_FETCH: source %d\n", pps->id);
 
@@ -143,11 +144,12 @@ static long pps_cdev_ioctl(struct file *file,
                if (err)
                        return -EFAULT;
 
-               pps->go = 0;
+               ev = pps->last_ev;
 
                /* Manage the timeout */
                if (fdata.timeout.flags & PPS_TIME_INVALID)
-                       err = wait_event_interruptible(pps->queue, pps->go);
+                       err = wait_event_interruptible(pps->queue,
+                                       ev != pps->last_ev);
                else {
                        unsigned long ticks;
 
@@ -159,7 +161,9 @@ static long pps_cdev_ioctl(struct file *file,
 
                        if (ticks != 0) {
                                err = wait_event_interruptible_timeout(
-                                               pps->queue, pps->go, ticks);
+                                               pps->queue,
+                                               ev != pps->last_ev,
+                                               ticks);
                                if (err == 0)
                                        return -ETIMEDOUT;
                        }

diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h
index 23f63c3263bb3c78162016fe559b7915744ad967..65194fe498bbdfe8212e6dc6c656595b3a3c28c1 100644 (file)
--- a/include/linux/pps_kernel.h
+++ b/include/linux/pps_kernel.h
@@ -55,7 +55,7 @@ struct pps_device {
        struct pps_ktime clear_tu;
        int current_mode;                       /* PPS mode at event time */
 
-       int go;                                 /* PPS event is arrived? */
+       unsigned int last_ev;                   /* last PPS event id */
        wait_queue_head_t queue;                /* PPS event queue */
 
        unsigned int id;                        /* PPS source unique ID */