linux/net
Johannes Berg 5abd25f01c rfkill: fix rfkill_fop_read wait_event usage
[ Upstream commit 6736fde967 ]

The code within wait_event_interruptible() is called with
!TASK_RUNNING, so mustn't call any functions that can sleep,
like mutex_lock().

Since we re-check the list_empty() in a loop after the wait,
it's safe to simply use list_empty() without locking.

This bug has existed forever, but was only discovered now
because all userspace implementations, including the default
'rfkill' tool, use poll() or select() to get a readable fd
before attempting to read.

Cc: stable@vger.kernel.org
Fixes: c64fb01627 ("rfkill: create useful userspace interface")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-02-15 15:45:28 -05:00
..
6lowpan 6lowpan: nhc: add other known rfc6282 compressions 2015-02-14 23:08:44 +01:00
9p 9p: ensure err is initialized to 0 in p9_client_read/write 2015-09-13 09:07:50 -07:00
802 net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
8021q vlan: Correctly propagate promisc|allmulti flags in notifier. 2015-05-14 00:54:32 -04:00
appletalk appletalk: Use eth_<foo>_addr instead of memset 2015-03-03 17:01:37 -05:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-04-15 09:00:47 -07:00
ax25 net: add validation for the socket syscall protocol argument 2016-01-22 20:54:13 -08:00
batman-adv batman-adv: Drop immediate orig_node free function 2016-01-31 11:23:38 -08:00
bluetooth bluetooth: Validate socket address length in sco_sock_bind(). 2016-01-22 20:54:15 -08:00
bridge bridge: fix lockdep addr_list_lock false positive splat 2016-01-31 11:23:37 -08:00
caif unix/caif: sk_socket can disappear when state is unlocked 2015-05-26 23:19:29 -04:00
can can: replace timestamp as unique skb attribute 2015-08-10 12:21:51 -07:00
ceph libceph: fix ceph_msg_revoke() 2016-02-15 15:45:18 -05:00
core net: bpf: reject invalid shifts 2016-01-31 11:23:37 -08:00
dcb net/dcb: Add IEEE QCN attribute 2015-03-06 21:50:02 -05:00
dccp tcp/dccp: fix timewait races in timer handling 2016-01-31 11:23:37 -08:00
decnet net: add validation for the socket syscall protocol argument 2016-01-22 20:54:13 -08:00
dns_resolver Merge commit 'v3.16' into next 2014-10-01 00:44:04 +10:00
dsa net: dsa: Do not override PHY interface if already configured 2015-09-29 19:26:26 +02:00
ethernet ethernet: Use eth_<foo>_addr instead of memset 2015-03-03 17:01:38 -05:00
hsr net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface. 2015-03-01 13:40:23 -05:00
ieee802154 ieee802154: Fix sockaddr_ieee802154 implicit padding information leak. 2015-08-03 09:28:59 -07:00
ipv4 xfrm: dst_entries_init() per-net dst_ops 2016-01-31 11:23:38 -08:00
ipv6 xfrm: dst_entries_init() per-net dst_ops 2016-01-31 11:23:38 -08:00
ipx net: Remove iocb argument from sendmsg and recvmsg 2015-03-02 13:06:31 -05:00
irda net: add validation for the socket syscall protocol argument 2016-01-22 20:54:13 -08:00
iucv Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-04-02 16:16:53 -04:00
key xfrm: simplify xfrm_address_t use 2015-03-31 13:58:35 -04:00
l2tp ipv6: add complete rcu protection around np->opt 2015-12-14 21:24:32 -08:00
lapb lapb: move EXPORT_SYMBOL after functions. 2014-10-24 15:51:42 -04:00
llc net: Remove iocb argument from sendmsg and recvmsg 2015-03-02 13:06:31 -05:00
mac80211 mac80211: Requeue work after scan complete for all VIF types. 2016-02-15 15:45:27 -05:00
mac802154 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 2015-05-09 15:51:00 -04:00
mpls mpls: handle device renames for per-device sysctls 2015-06-11 16:47:16 -07:00
netfilter ipvs: call skb_sender_cpu_clear 2015-10-22 14:43:20 -07:00
netlabel netlink: implement nla_put_in_addr and nla_put_in6_addr 2015-03-31 13:58:35 -04:00
netlink netlink: Add missing goto statement to netlink_insert 2015-12-09 14:03:28 -05:00
netrom net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
nfc NFC: nci: extract pipe value using NCI_HCP_MSG_GET_PIPE 2015-12-09 14:03:20 -05:00
openvswitch net: preserve IP control block during GSO segmentation 2016-01-31 11:23:36 -08:00
packet packet: fix tpacket_snd max frame len 2015-12-14 21:24:29 -08:00
phonet phonet: properly unshare skbs in phonet_rcv() 2016-01-31 11:23:36 -08:00
rds RDS: fix race condition when sending a message on unbound socket 2015-12-14 21:24:32 -08:00
rfkill rfkill: fix rfkill_fop_read wait_event usage 2016-02-15 15:45:28 -05:00
rose net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
rxrpc new helper: msg_data_left() 2015-04-11 15:53:35 -04:00
sched net: sched: fix missing free per cpu on qstats 2016-01-31 11:23:36 -08:00
sctp sctp: Prevent soft lockup when sctp_accept() is called during a timeout event 2016-01-31 11:23:38 -08:00
sunrpc svcrdma: handle rdma read with a non-zero initial page offset 2015-10-27 09:51:59 +09:00
switchdev rename RTNH_F_EXTERNAL to RTNH_F_OFFLOAD 2015-05-14 22:45:39 -04:00
tipc tipc: linearize arriving NAME_DISTR and LINK_PROTO buffers 2015-12-09 14:03:11 -05:00
unix unix: properly account for FDs passed over unix sockets 2016-01-31 11:23:36 -08:00
vmw_vsock net: Remove iocb argument from sendmsg and recvmsg 2015-03-02 13:06:31 -05:00
wimax wimax: convert printk to pr_foo() 2014-10-07 20:28:44 -04:00
wireless nl80211: Fix potential memory leak from parse_acl_data 2015-12-09 14:03:19 -05:00
x25 net: Remove iocb argument from sendmsg and recvmsg 2015-03-02 13:06:31 -05:00
xfrm xfrm: dst_entries_init() per-net dst_ops 2016-01-31 11:23:38 -08:00
compat.c net: switch importing msghdr from userland to {compat_,}import_iovec() 2015-04-09 00:02:26 -04:00
Kconfig kconfig: use bool instead of boolean for type definition attributes 2015-01-07 13:08:04 +01:00
Makefile mpls: Refactor how the mpls module is built 2015-03-04 00:26:06 -05:00
socket.c net: fix uninitialized variable issue 2016-01-22 20:54:15 -08:00
sysctl_net.c net: Update the sysctl permissions handler to test effective uid/gid 2013-10-07 15:57:56 -04:00